{"text_format":"3","workbook":"xlsx","n_sheets":13,"sheets":["What is the K-12CVAT","Introduction","Instructions","K-12CVAT","Standards Crosswalk","Analyst Report","Analyst Reference","Summary Report","Crosswalk Detail","High Risk Non-Compliant","Questions","Values","ChangeLog"],"not_rendered":{"charts":1,"images":3,"defined_names":6,"comments":1,"pivot_tables":1},"read":"whole","date_system":"1900"}

{"sheet":"What is the K-12CVAT","index":0,"n_rows":55,"n_cols":1,"rows_kept":55,"merged":[[0,0,0,1],[54,0,54,1]]}
{"$rows_empty":54}
["Proceed to the next tab, Introduction."]

{"sheet":"Introduction","index":1,"n_rows":55,"n_cols":1,"rows_kept":55,"merged":[[0,0,0,1],[54,0,54,1]]}
{"$rows_empty":54}
["Proceed to the next tab, Instructions."]

{"sheet":"Instructions","index":2,"n_rows":24,"n_cols":2,"rows_kept":24,"merged":[[0,0,0,1],[1,0,1,1],[2,0,2,1],[3,0,3,1],[4,0,4,1],[5,0,5,1],[10,0,10,1],[11,0,11,1],[12,0,12,1],[16,0,16,1],[18,0,18,1],[19,0,19,1],[20,0,20,1],[21,0,21,1],[22,0,22,1],[23,0,23,1]]}
["K-12 Vendor Assessment Tool - Lite - Instructions"]
[]
["Target Audience"]
["These instructions are for vendors interested in providing the school system with a software and/or a service. \nThis worksheet should not be completed by the K-12 school system entity. The purpose of this worksheet is for the vendor to submit robust security safeguard information in regards to the product (software/service) being assessed in the Institution's assessment process."]
["Document Layout"]
["There are four main sections of the K-12 Community Vendor Assessment Tool - Lite, all listed below and outlined in more detail. Within each section, answer each question top-to-bottom. Some questions are nested and may be blocked out via formatting based on previous answers. Populating this document in the correct order improves efficiency.                                                            \nDo not overwrite selection values (data validation) in column C of the K-12CVAT - Lite tab."]
["General Information","This section is self-explanatory; product specifics and contact information. GNRL-01 through GNRL-10 should be populated by the Vendor. GNRL-11 and GNRL-12 are for K-12 School System/Institution use only."]
["Documentation","Focused on external documentation, the Institution is interested in the frameworks that guide your security strategy and what has been done to certify these implementations."]
["Company Overview","This section is focused on company background, size, and business area experience."]
["Safeguards","The remainder of the document consists of various safeguards, grouped generally by section."]
["In sections where vendor input is required there are only one or two columns that need modification, Vendor Answers and Additional Information, columns C and D respectively (see Figure 1 below). You will see that sometimes C and D are separate and other times are merged. If they are separate, C will be a selectable, drop-down box and any supporting information should be added to column D. If C and D are merged, the question is looking for the answer to be in narrative form. At the far right is a column titled “Guidance”. After answering questions, check this column to ensure you have submitted information/documentation to sufficiently answer the question. Use the “Additional Information” column to provide any requested details."]
["Figure 1: "]
["Definitions and Data Zones"]
["Institution","Any school, school district, education service district or K-12 institution using the K-12 Education Community Vendor Assessment Tool Lite"]
["Institution Data Zone","The country/region in which an Institution is located, including all laws and regulations in-scope within that country/region."]
["Vendor Data Zone","The country/region in which a vendor is headquartered and/or serves its products/services, including all laws and regulations in-scope within that country/region."]
["Customers from different regions may expect vary protections of data (e.g. GDPR), this is the Institution Data Zone. Vendors may handle data differently depending on the country or region where data is stored, this is the Vendor Data Zone.\nAs a vendor, if your security practices vary based on your region of operation, you may want to populate a K-12CVAT in the context for each security zone (strategy). That said, Institutions from different data zones may still use vendor responses from other state Data Zones. If your security practices are the same across all regions of operations, indicate \"All\" in your Vendor Data Zone."]
[null,"Example A: If vendor ABC is headquartered and stores data in Canada, and provides services to only customers in Canada, ABC should state \"Canada\" in both Data Zone fields.\nExample B: If vendor ABC is headquartered and stores data in Canada, and additionally provides services to customers in the United Kingdom, ABC may want to assure customers in the United Kingdom that their data is handled properly for their region. In that case, ABC should state \"Canada\" in the Vendor Data Zone and \"United Kingdom\" in the Institution Data Zone.\nExample C: If your security strategy is broad and doesn't fit this statement model, provide a brief summary in each field and the Institution's Security Analyst can assess your response."]
["Data Reporting"]
["To update data in the Report tabs, click Refresh All in the Menu tab. Input provided in the K-12CVAT tab is assessed a preliminary score pending Institution's Security Analyst review."]
["Proceed to the next tab, K-12CVAT - Lite."]
[]
["For Institution's Security Analysts"]
["1. Raw vendor answers can be viewed on the K-12CVAT tab. \n2. To begin your assessment, review the Analyst Report tab, ensuring that you select the appropriate security standard used in your institution (cell B7) before you begin. \n3. Review the Analyst Reference tab for guidance and question/response interpretation.\n4. Select compliance states for the outstanding non-compliant or short-answer questions in column G. Once all subjective questions are evaluated and compliance indicated, move to the Summary Report tab. \n5. To update the report's data, select Refresh All in the Data menu. Review details in the Summary Report and based on your assessment, follow-up with vendor for clarification(s) or add the Summary Report output to your Institution's reporting documents. "]

{"sheet":"K-12CVAT","index":3,"n_rows":99,"n_cols":7,"rows_kept":99,"merged":[[0,0,0,3],[1,0,1,4],[2,2,2,4],[3,0,3,4],[4,0,4,4],[5,0,5,4],[6,2,6,4],[7,2,7,4],[8,2,8,4],[9,2,9,4],[10,2,10,4],[11,2,11,4],[12,2,12,4],[13,2,13,4],[14,2,14,4],[15,2,15,4],[16,0,16,4],[17,2,17,4],[18,2,18,4],[19,0,19,4],[20,0,20,4],[21,0,21,1],[28,0,28,1],[29,2,29,3],[30,2,30,3],[37,2,37,3],[38,0,38,1],[47,0,47,1],[52,0,52,1],[57,0,57,1],[61,0,61,1],[68,0,68,1],[70,0,70,1],[74,0,74,1],[78,0,78,1],[83,0,83,1],[86,0,86,1],[91,0,91,1],[95,0,95,1]]}
["K-12 Community Vendor Assessment Tool (CVAT) - Lite",{"$nulls":3},"Version 3.0"]
[]
["DATE-01","Date","mm/dd/yyyy"]
["General Information"]
["In order to protect the institution (school, district or service district) and its systems, vendors whose products and/or services will access and/or host institutional data must complete the K-12 Community Vendor Assessment Toolkit. Throughout this tool, anywhere where the term data is used, this is an all-encompassing term including at least data and metadata. Answers will be reviewed by institution security analysts upon submittal. This process will assist the institution in preventing breaches of protected information and comply with institution policy, state, and federal law. This is intended for use by vendors and should be completed by the vendor."]
["GNRL-01 through GNRL-15; populated by Vendor"]
["GNRL-01","Vendor Name","Vendor Name"]
["GNRL-02","Product Name","Product Name and Version Information"]
["GNRL-03","Product Description","Brief Description of the Product"]
["GNRL-04","Web Link to Product Privacy Notice","http://www.vendor.domain/privacynotice"]
["GNRL-05","Vendor Contact Name","Vendor Contact Name"]
["GNRL-06","Vendor Contact Title","Vendor Contact Title"]
["GNRL-07","Vendor Contact Email","Vendor Contact E-mail Address"]
["GNRL-08","Vendor Contact Phone Number","555-555-5555"]
["GNRL-09","Vendor Data Zone","See Instructions tab for guidance"]
["GNRL-10","Institution Data Zone","See Instructions tab for guidance"]
["GNRL-11 and GNRL-12; populated by Institution's Information Technology or Security Office"]
["GNRL-11","School Organization Security Analyst/Engineer","Institution's Security Analyst/Engineer Name"]
["GNRL-12","Assessment Contact","ticket#@yourdomain.edu"]
["Instructions"]
["Step 1: Complete each section answering each set of questions in order from top to bottom; the built-in formatting logic relies on this order. Step 2: Submit the completed K-12 Community Vendor Assessment Toolkit - Lite to the institution according to institutional procedures."]
["Documentation",null,"Vendor Answers","Additional Information","Guidance"]
["DOCU-01","Have you undergone a SSAE 18 audit?",null,null,{"$f":"IF(C23=\"\",\"\",IF(C23=\"Yes\",\"Provide the date of assessment and include a SOC 2 Type 2 (preferred) or SOC 3 report. If you have a SOC3 report, include a URL for the published report. Indicate if your hosting provider was the subject of the audit.\",\"Describe any plans to undergo a SSAE 16 audit.\"))","v":""}]
["DOCU-02","Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?",null,null,{"$f":"IF(C24=\"\",\"\",IF(C24=\"Yes\",\"Please include a copy with your response and include a URL for the published assessment.\",\"Describe any plans to complete the CSA self assessment or CAIQ.\"))","v":""}]
["DOCU-03","Have you received the Cloud Security Alliance STAR certification?"]
["DOCU-04","Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) Please identify which one under \"additional information\"",null,null,{"$f":"IF(C26=\"\",\"\",IF(C26=\"Yes\",\"Provide documentation on how your organization conforms to each framework and indicate current certification levels, where appropriate.\",\"Describe any plans to conform to an industry standard security framework.\"))","v":""}]
["DOCU-05","Are you compliant with FISMA standards?",null,null,{"$f":"IF(C27=\"\",\"\",IF(C27=\"Yes\",\"Indicate level, agency issuing ATO, and necessary details on ATO. If using FEDRamp, please indicate the supporting details.\",\"Describe any plans to become FISMA compliant.\"))","v":""}]
["DOCU-06","Would you sign the Student Data Privacy Consortium statement for the state in which our district is located? (https://sdpc.a4l.org/) ",null,null,{"$f":"IF(C28=\"\",\"\",IF(C28=\"Yes\",\"Provide your data privacy document (or a valid link to it) upon submission.\",\"Describe your plans to provide a data privacy document.\"))","v":""}]
["Company Overview",null,"Vendor Answers","Additional Information","Guidance"]
["COMP-01","Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships.",null,null,"Include circumstances that may involve off-shoring or multi-national agreements."]
["COMP-02","Describe how long your organization has conducted business in this product area.",null,null,"Include the number of years and in what capacity."]
["COMP-03","Do you have existing K-12 customers?",null,null,{"$f":"IF(C32=\"\",\"\",IF(C32=\"Yes\",\"Provide a list of K-12 Education references, with contact information.\",\"State your primary industry.\"))","v":""}]
["COMP-04","Have you had a significant cybersecurity incident that has disrupted availability for longer than 8 hours? ",null,null,{"$f":"IF(C33=\"\",\"\",IF(C33=\"Yes\",\"Provide a detailed summary of the incident.\",\"\"))","v":""}]
["COMP-05","Have you had a security event in the last 5 years that impacted privacy, operations, data, customers, what steps did you take to handle the incident? ",null,null,{"$f":"IF(C34=\"\",\"\",IF(C34=\"Yes\",\"Provide a detailed summary of the incident.\",\"\"))","v":""}]
["COMP-06","Do you have a formal risk management and cybersecurity program in place?",null,null,{"$f":"IF(C35=\"\",\"\",IF(C35=\"Yes\",\"Decribe your risk management and cybersecurity program.\",\"Describe any plans to create a risk management and/or cybersecurity program for your organization.\"))","v":""}]
["COMP-07","If applicable, do you have dedicated customer support and product management? ",null,null,{"$f":"IF(C36=\"\",\"\",IF(C36=\"Yes\",\"Please provide a copy of your MSA or SLA that describes your support model.\",\"Describe any plans to create an an MSA or SLA for your customer support and project management.\"))","v":""},"APPL-04"]
["COMP-08","If applicable, do you have dedicated software and systems development teams? ",null,null,{"$f":"IF(C37=\"\",\"\",IF(C37=\"Yes\",\"Please provide a copy of your MSA or SLA that describes your development model.\",\"\"))","v":""}]
["COMP-09","Use this area to share information about your environment that will assist those who are assessing your company data security program.",null,null,"Share any details that would help information security analysts assess your product.","APPL-05"]
["Application/Service Security",null,"Vendor Answers","Additional Information","Guidance","APPL-08"]
["HLAP-01","Does you system support various permission levels (for example, role based access control) for end users?",null,null,{"$f":"IF(C40=\"\",\"\",IF(C40=\"Yes\",\"Please describe your end user permission levels.\",\"Describe any plans to support various permission levels for end users.\"))","v":""},"APPL-01"]
["HLAP-02","Do you enforce additional security controls for privileged access users (e.g. system administrators)? ",null,null,{"$f":"IF(C41=\"\",\"\",IF(C41=\"Yes\",\"Please describe security controls for privleged access users.\",\"Describe any plans to implement additional security controls for privleged access users.\"))","v":""},"APPL-02"]
["HLAP-03","Can employees access protected or sensitive data remotely?",null,null,{"$f":"IF(C42=\"\",\"\",IF(C42=\"Yes\",\"Please describe controls in place to protect data in remote access scenarios.\"))","v":""},"APPL-03"]
["HLAP-04","Is an audit log of access maintained by the system?",null,null,{"$f":"IF(C43=\"\",\"\",IF(C43=\"Yes\",\"Please describe how frequently audit logs are reviewed and audited.\",\"Describe any plans to implement access audit logs.\"))","v":""}]
["HLAP-05","If necessary would you be willing to share systems schematics, diagrams, data flow diagrams, etc. ? ",null,null,{"$f":"IF(C44=\"\",\"\",IF(C44=\"Yes\",\"Provide a reference to the requested documents or provide them when submitting this fully-populated K-12CVAT.\",\"State any plans to provide system and/or application architecture diagrams.\"))","v":""},"APPL-04"]
["HLAP-06","Has your system been tested for input validation errors and do you have appropriate error messaging? ",null,null,{"$f":"IF(C45=\"\",\"\",IF(C45=\"Yes\",\"Provide a reference to documentation of your data input validation and error messaging capabilities.\",\"State plans to implement data input validation and error messaging across all components of your system.\"))","v":""},"APPL-05"]
["HLAP-07","Is district data appropriately segmented and secured from other organization's data or access and can you demonstrate through reports? ",null,null,{"$f":"IF(C46=\"\",\"\",IF(C46=\"Yes\",\"Describe your multi tenancy security practices.\",\"Describe any plans to implement data segmentation and reporting.\"))","v":""},"APPL-06"]
["HLAP-08","Do you have a quality multi tenancy environment with good reporting? ",null,null,{"$f":"IF(C47=\"\",\"\",IF(C47=\"Yes\",\"Describe your multi tenancy environment and reporting practices.\",\"Describe your single tenant approach.\"))","v":""},"APPL-06"]
["Authentication, Authorization, and Accounting",null,"Vendor Answers","Additional Information","Guidance"]
["HLAA-01","Do you have strong authentication in place including MFA and additional controls for privileged access accounts?",null,null,{"$f":"IF(C49=\"\",\"\",IF(C49=\"Yes\",\"Describe your authentication controls.\",\"Describe plans to support strong authentication and MFA requirements.\"))","v":""},"AAAI-01"]
["HLAA-02","Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. SAMAL, OAuth, ClassLink, etc.)",null,null,{"$f":"IF(C50=\"\",\"\",IF(C50=\"Yes\",\"Describe or provide a reference to the supported types of authentication.\",\"Describe plans to support authentication in your web-based interface.\"))","v":""},"AAAI-05"]
["HLAA-03","Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication?",null,null,{"$f":"IF(C51=\"\",\"\",IF(C51=\"Yes\",\"Describe all authentication services supported by the system.\",\"Describe any plans to support external authentication services in place of local authentication.\"))","v":""},"AAAI-12"]
["HLAA-04","Do K-12 district staff have access to audit logs that allow them to see actions and activities taken by their users?",null,null,{"$f":"IF(C52=\"\",\"\",IF(C52=\"Yes\",\" Provide a description of logging capabilities.\",\"Describe any plans to enable audit logs for K-12 district staff.\"))","v":""},"AAAI-15"]
["Business Continuity Plan",null,"Vendor Answers","Additional Information","Guidance","BCPL-06"]
["HLBC-01","Do you have a documented Business Continuity Plan (BCP)?",null,null,{"$f":"IF(C54=\"\",\"\",IF(C54=\"Yes\",\"Provide a copy of your BCP along with this document (link or attached).\",\"Describe your intention to complete a Business Continuity Plan.\"))","v":""},"QUAL-04"]
["HLBC-02","Is there a documented communication plan in your BCP for impacted clients?",null,null,{"$f":"IF(C55=\"\",\"\",IF(C55=\"Yes\",\"Summarize your documented communication plan contained in your BCP.\",\"Describe any plans to document a communication plan in your BCP.\"))","v":""},"BCPL-05"]
["HLBC-03","Are all components of the BCP reviewed at least annually and updated as needed to reflect change? ",null,null,{"$f":"IF(C56=\"\",\"\",IF(C56=\"Yes\",\"Describe your BCP component review strategy.\",\"Describe any plans to annually review and update (as needed) your BCP.\"))","v":""},"BCPL-06"]
["HLBC-04","Does your organization regularly test the failover or recovery of production environment for the purposes of BCP and continuity? ",null,null,{"$f":"IF(C57=\"\",\"\",IF(C57=\"Yes\",\"State the date of your last failover or recovery test.\",\"Describe your strategy to implement failover and recovery testing.\"))","v":""},"BCPL-11"]
["Change Management",null,"Vendor Answers","Additional Information","Guidance"]
["HLCH-01","Do you have a documented and currently followed change management process (CMP) for standard and emergency changes? ",null,null,{"$f":"IF(C59=\"\",\"\",IF(C59=\"Yes\",\"Summarize your current change management process.\",\"Describe current plans to implement a change management process.\"))","v":""},"CHNG-01"]
["HLCH-02","Will the district be notified of  changes to your environment that could impact the district's security posture or service availability?",null,null,{"$f":"IF(C60=\"\",\"\",IF(C60=\"Yes\",\"State how and when the district will be notified of major changes to your environment.\",\"Describe plans to establish a notification mechanism for major environmental changes.\"))","v":""},"CHNG-03"]
["HLCH-03","Do you have policy and procedure, currently implemented, guiding how known vulnerabilities and zero day attack risks are mitigated until patches are available and applied?",null,null,{"$f":"IF(C61=\"\",\"\",IF(C61=\"Yes\",\"Summarize the policy and procedure(s) guiding risk mitigation practices before critical patches can be applied.\",\"State your plans to implement policy and procedure(s) guiding risk mitigation practices before critical patches can be applied.\"))","v":""},"CHNG-13"]
["Data",null,"Vendor Answers","Additional Information","Guidance"]
["HLDA-01","Do you  logically separate institution's data from that of other customers?",null,null,{"$f":"IF(C63=\"\",\"\",IF(C63=\"Yes\",\"Describe or provide a reference to how institution data is logically separated from that of other customers.\",\"Describe your plan to logically separate institution's data from other customers.\"))","v":""},"DATA-01"]
["HLDA-02","Is sensitive data encrypted in transport? (e.g. system-to-client)",null,null,{"$f":"IF(C64=\"\",\"\",IF(C64=\"Yes\",\"Summarize your transport encryption strategy and include the level of encryption currently in use.\",\"Decribe why sensitive data in not encrypted in transport.\"))","v":""},"DATA-03"]
["HLDA-03","Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)?",null,null,{"$f":"IF(C65=\"\",\"\",IF(C65=\"Yes\",\"Summarize your data encryption strategy.\",\"Decribe why sensitive data in not encrypted in storage.\"))","v":""},"DATA-04"]
["HLDA-04","Do backups containing institution data ever leave the United States, either physically or via network routing?",null,null,{"$f":"IF(C66=\"\",\"\",IF(C66=\"Yes\",\"Summarize why backups containing the institution's data leave the United States.\",\"\"))","v":""},"DATA-23"]
["HLDA-05","Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures?",null,null,{"$f":"IF(C67=\"\",\"\",IF(C67=\"Yes\",\"Provide details of these procedures (link or attached).\",\"Provide a detailed summary for this response.\"))","v":""},"DATA-24"]
["HLDA-06","Is any institution data visible in system administration modules/tools?",null,null,{"$f":"IF(C68=\"\",\"\",IF(C68=\"Yes\",\"Summarize why the institution's data is visible in system adminitration modules/tools.\",\"\"))","v":""},"DATA-29"]
["Database",null,"Vendor Answers","Additional Information","Guidance"]
["HLDB-01","Does the database implement encryption of specified data elements in storage consistent with current encryption standards?",null,null,{"$f":"IF(C70=\"\",\"\",IF(C70=\"Yes\",\"Describe the type of encryption that is supported including the versions/levels of encryption you support. \",\"State plans to support database encryption (in storage) of specified data elements.\"))","v":""},"DBAS-01"]
["Datacenter",null,"Vendor Answers","Additional Information","Guidance","DCTR-02"]
["HLDC-01","Will any institution data leave the United States?",null,null,{"$f":"IF(C72=\"\",\"\",IF(C72=\"Yes\",\"Summarize the strategy for removing institution's data from the US.\",\"\"))","v":""},"DCTR-09"]
["HLDC-02","Does your company own the physical data center where the institution's data will reside?",null,null,{"$f":"IF(C73=\"\",\"\",IF(C73=\"Yes\",\"Provide a brief summary of your data center strategy.\",\"Provide a detailed description of where the institution's data will reside. If using a public cloud provider, please describe how you handle data segregation.\"))","v":""},"DCTR-01"]
["HLDC-03","Does the hosting provider have a SOC 2 Type 2 report available?",null,null,{"$f":"IF(C74=\"\",\"\",IF(C74=\"Yes\",\"Obtain the report if possible and add it to your submission.\",\"Describe your willingness to have an outside third party conduct a review and share under an NDA.\"))","v":""},"DCTR-02"]
["Disaster Recovery Plan",null,"Vendor Answers","Additional Information","Guidance","DRPL-13"]
["HLDR-01","Do you have a Disaster Recovery Plan (DRP)?",null,null,{"$f":"IF(C76=\"\",\"\",IF(C76=\"Yes\",\"Describe or provide a reference to your Disaster Recovery Plan (DRP).\",\"State any plans to create a Disaster Recovery Plan.\"))","v":""},"QUAL-05"]
["HLDR-02","Are any disaster recovery locations outside the institution's of the United States?",null,null,{"$f":"IF(C77=\"\",\"\",IF(C77=\"Yes\",\"List all locations outside of the U.S. and provide a brief summary of each.\",\"\"))","v":""},"DRPL-04"]
["HLDR-03","Are all components of the DRP reviewed at least annually and updated as needed to reflect change? ",null,null,{"$f":"IF(C78=\"\",\"\",IF(C78=\"Yes\",\"Summarize your DRP review and update processes and/or procedures.\",\"State plans to implement annual (at a minimum) testing of your DRP.\"))","v":""},"DRPL-12"]
["Firewalls, IDS, IPS, and Networking",null,"Vendor Answers","Additional Information","Guidance"]
["HLFI-01","Are you utilizing a web application firewall (WAF) and/or a stateful packet inspection (SPI) firewall?",null,null,{"$f":"IF(C80=\"\",\"\",IF(C80=\"Yes\",\"Describe the currently implemented WAF.\",\"Describe compensating controls that protect your web application, if applicable.\"))","v":""},"FIDP-01","FIDP-02"]
["HLFI-02","Do you have a documented policy for firewall change requests?",null,null,{"$f":"IF(C81=\"\",\"\",IF(C81=\"Yes\",\"Describe your documented firewall change request policy.\",\"Describe your plans to implement a documented policy for firewall change requests.\"))","v":""},"FIDP-04"]
["HLFI-03","Do you have automated  threat monitoring and notification systems enabled? (for example, SEIM, EDPM, etc.)",null,null,{"$f":"IF(C82=\"\",\"\",IF(C82=\"Yes\",\"Describe your threat monitoring and notification capability.\",\"Describe your intent to implement a threat monitoring capability.\"))","v":""},"FIDP-09"]
["HLFI-04","Is there a 24x7x365 monitoring and response process in place for intrusions?",null,null,{"$f":"IF(C83=\"\",\"\",IF(C83=\"Yes\",\"Provide a brief summary of this activity including expected response time.\",\"State plans to implement 24x7x365 intrusion monitoring in your environment(s).\"))","v":""}]
["Physical Security",null,"Vendor Answers","Additional Information","Guidance"]
["HLPH-01","Does your organization have physical security controls and policies in place?",null,null,{"$f":"IF(C85=\"\",\"\",IF(C85=\"Yes\",\"Provide a copy of your physical security controls and policies along with this document (link or attached).\",\"Describe your intent to implement physical security controls and policies.\"))","v":""},"PHYS-01"]
["HLPH-02","Are employees allowed to access or transport customer data, copy or store customer data on personally owned devices, or physically remove data from the protected infrastructure of your organization? ",null,null,{"$f":"IF(C86=\"\",\"\",IF(C86=\"Yes\",\"Describe or provide a reference to how data is protected from inappropriate access or transport.\",\"\"))","v":""},"PPPR-08"]
["Policies, Procedures, and Processes",null,"Vendor Answers","Additional Information","Guidance","PPPR-11"]
["HLPP-01","Can you share the organization chart, mission statement, and policies for your information security unit?",null,null,{"$f":"IF(C88=\"\",\"\",IF(C88=\"Yes\",\"Provide a links to these documents in Additional Information or attach them with your submission or indicate if access to these documents requires an NDA.\",\"Provide a brief summary for this response.\"))","v":""},"PPPR-18"]
["HLPP-02","Are information security principles designed into the product lifecycle (e.g. are you incorporating and upgrading security as an essential design element)?",null,null,{"$f":"IF(C89=\"\",\"\",IF(C89=\"Yes\",\"Summarize the information security principles designed into the product lifecycle.\",\"Describe why security principles are not designed into the product lifecycle.\"))","v":""},"PPPR-08"]
["HLPP-03","Do you have a formal, documented incident response plan that covers physical and cyber incident response and defined severity levels?",null,null,{"$f":"IF(C90=\"\",\"\",IF(C90=\"Yes\",\"Summarize your formal incident response plan.\",\"State plans to formalize an incident response plan.\"))","v":""},"PPPR-10"]
["HLPP-04","Do you have a documented information security policy?",null,null,{"$f":"IF(C91=\"\",\"\",IF(C91=\"Yes\",\"Provide a reference to your information security policy or submit documentation with this fully-populated K-12CVAT-Lite.\",\"State plans to implement information security policy at your company.\"))","v":""},"PPPR-16"]
["Systems Management & Configuration",null,"Vendor Answers","Additional Information","Guidance"]
["HLSY-01","Do you employ network and administrative segmentation in the management of this service? (for example, systems supporting the service managed via a separate management network, separate administrative controls and access, etc.)",null,null,{"$f":"IF(C93=\"\",\"\",IF(C93=\"Yes\",\"Provide a brief description of how this is implemented.\",\"Describe your strategy to maintain system integrity (e.g. compensating controls).\"))","v":""},"SYST-01"]
["HLSY-02","Do you have standard hardened configurations for severs, appliances and mobile devices?",null,null,{"$f":"IF(C94=\"\",\"\",IF(C94=\"Yes\",\"Summarize your systems management and configuration strategy.\",\"Describe your intent to implement a systems management and configuration strategy.\"))","v":""}]
["HLSY-03","Do you encrypt company owned mobile devices?",null,null,{"$f":"IF(C95=\"\",\"\",IF(C95=\"Yes\",\"Summarize your systems management and configuration strategy.\",\"Describe your intent to implement a systems management and configuration strategy.\"))","v":""},"VULN-03"]
["Vulnerability Scanning",null,"Vendor Answers","Additional Information","Guidance"]
["HLVU-01","Have your systems and applications had a third party security assessment completed in the last year?",null,null,{"$f":"IF(C97=\"\",\"\",IF(C97=\"Yes\",\"Provide the results with this document (link or attached), if possible. State the date of the last completed third party security assessment.\",\"State plans to have your systems and applications assessed by a third party.\"))","v":""},"VULN05","VULN-02"]
["HLVU-02","Are your applications scanned for vulnerabilities [that are remediated]?                            ",null,null,{"$f":"IF(C98=\"\",\"\",IF(C98=\"Yes\",\"Provide a brief description and include the frequency with which scanning occurs.\",\"Describe plans to implement application vulnerability scanning [and remediation] prior to release.\"))","v":""}]
["HLVU-03","Are your systems scanned for vulnerabilities [that are remediated]?                            ",null,null,{"$f":"IF(C99=\"\",\"\",IF(C99=\"Yes\",\"Provide a brief description and include the frequence with which scanning occurs.\",\"Describe plans to implement systems vulnerability scanning [and remediation] prior to release.\"))","v":""}]

{"sheet":"Standards Crosswalk","index":4,"n_rows":104,"n_cols":9,"rows_kept":104,"merged":[[0,0,0,7],[1,0,1,7],[21,0,21,1],[28,0,28,1],[38,0,38,1],[45,0,45,1],[50,0,50,1],[55,0,55,1],[59,0,59,1],[66,0,66,1],[68,0,68,1],[72,0,72,1],[76,0,76,1],[81,0,81,1],[84,0,84,1],[89,0,89,1],[93,0,93,1]]}
["K-12 Community Vendor Assessment Tool (K-12CVAT)  - Standards Crosswalk"]
{"$rows_empty":20}
["Documentation",null,"CIS Critical Security Controls v6.1","HIPAA","ISO 27002:2013","NIST Cybersecurity Framework","NIST SP 800-171r1","NIST SP 800-53r4"]
["DOCU-01",{"$f":"VLOOKUP(A23,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Have you undergone a SSAE 18 audit?"},null,null,"15.2.1",null,null,"SA-9"]
["DOCU-02",{"$f":"VLOOKUP(A24,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?"},null,null,"15.2.1",null,null,"PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9"]
["DOCU-03",{"$f":"VLOOKUP(A25,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Have you received the Cloud Security Alliance STAR certification?"},null,null,"15.2.1",null,null,"PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9"]
["DOCU-04",{"$f":"VLOOKUP(A26,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) Please identify which one under \"additional information\""},null,null,"18.1.1",null,null,"SA-9"]
["DOCU-05",{"$f":"VLOOKUP(A27,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are you compliant with FISMA standards?"},null,null,"18.1.1",null,null,"SA-9"]
["DOCU-06",{"$f":"VLOOKUP(A28,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Would you sign the Student Data Privacy Consortium statement for the state in which our district is located? (https://sdpc.a4l.org/) "},null,"§164.308(a)(1)(i)","18.1.4","ID.GV-3","ID.GV-3","SA-9"]
["Company Overview",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["COMP-01",{"$f":"VLOOKUP(A30,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships."}]
["COMP-02",{"$f":"VLOOKUP(A31,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Describe how long your organization has conducted business in this product area."}]
["COMP-03",{"$f":"VLOOKUP(A32,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have existing K-12 customers?"},null,null,"15.2.1"]
["COMP-04",{"$f":"VLOOKUP(A33,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Have you had a significant cybersecurity incident that has disrupted availability for longer than 8 hours? "},null,null,"15.2.2"]
["COMP-04.5","Have you had more than one security event in the last 5 years that impacted privacy, operations, data, customers, what steps did you take to handle the incident? IF yes, please describe the steps you took to improve your security and reduce risk.",null,null,"15.2.2"]
["COMP-05",{"$f":"VLOOKUP(A35,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Have you had a security event in the last 5 years that impacted privacy, operations, data, customers, what steps did you take to handle the incident? "},null,null,"15.2.1"]
["COMP-06",{"$f":"VLOOKUP(A36,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a formal risk management and cybersecurity program in place?"},null,null,"14.2.1",null,null,"SA-3, SA-15, SC-2, PM-2, PM-10, SI-5,PM-3 "]
["COMP 07","If applicable, do you have dedicated software and systems development teams? ",null,null,"14.2.1"]
["COMP-08",{"$f":"VLOOKUP(A38,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"If applicable, do you have dedicated software and systems development teams? "},null,null,"15.2.1"]
["Application/Service Security",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLAP-01",{"$f":"VLOOKUP(A40,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does you system support various permission levels (for example, role based access control) for end users?"},"CSC 14",null,"9.2.2","PR.AC-4","3.1.1, 3.1.2, 3.1.7","AC-2, AC-3, AC-6","APPL-03"]
["HLAP-02",{"$f":"VLOOKUP(A41,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you enforce additional security controls for privileged access users (e.g. system administrators)? "},"CSC 16",null,"9.1.1","PR.AC-4, PR.PT-3","3.4.9","CM-11","APPL-04"]
["HLAP-03",{"$f":"VLOOKUP(A42,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Can employees access protected or sensitive data remotely?"},"CSC 12",null,6.2,"PR.PT-3","3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.8, 3.1.20, 3.7.5, 3.8.2, 3.13.7","AC-3, CM-7; NIST SP 800-46","APPL-07"]
["HLAP-04",{"$f":"VLOOKUP(A43,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is an audit log of access maintained by the system?"},"CSC 2",null,"12.1.1","ID.AM-1, ID.AM-2, ID.AM-4",null,"CA-9, SC-4","APPL-11"]
["HLAP-05",{"$f":"VLOOKUP(A44,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"If necessary would you be willing to share systems schematics, diagrams, data flow diagrams, etc. ? "},"CSC 16",null,"14.2.5","PR.DS-6",null,null,"APPL-18"]
["HLAP-06",{"$f":"VLOOKUP(A45,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Has your system been tested for input validation errors and do you have appropriate error messaging? "},"CSC 12",null,"14.2.5",null,null,"RA-2","APPL-19"]
["Authentication, Authorization, and Accounting",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLAA-01",{"$f":"VLOOKUP(A47,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have strong authentication in place including MFA and additional controls for privileged access accounts?"},"CSC 16",null,"9.2.3, 9.3.1, 9.4.3","PR.AC-1","3.5.7","IA-5(1)","AAAI-02"]
["HLAA-02",{"$f":"VLOOKUP(A48,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. SAMAL, OAuth, ClassLink, etc.)"},"CSC 16",null,"9.1.1, 9.2.3, 9.3.1, 9.4.3","PR.AC-1","3.5.1","IA-2, IA-5","AAAI-05"]
["HLAA-03",{"$f":"VLOOKUP(A49,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication?"},"CSC 16",null,"9.4.3","PR.AC-1, PR.AC-4",null,null,"AAAI-12"]
["HLAA-04",{"$f":"VLOOKUP(A50,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do K-12 district staff have access to audit logs that allow them to see actions and activities taken by their users?"},"CSC 16",null,"9.4.3","PR.AC-1, PR.AC-4",null,null,"AAAI-14"]
["Business Continuity Plan",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLBC-01",{"$f":"VLOOKUP(A52,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a documented Business Continuity Plan (BCP)?"},"CSC 10",null,"17.1.1","PR.IP-9","3.12.2","AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34","BCPL-01"]
["HLBC-02",{"$f":"VLOOKUP(A53,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is there a documented communication plan in your BCP for impacted clients?"},"CSC 10",null,"17.1.2","PR.IP-9","3.12.2","AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34","BCPL-05"]
["HLBC-03",{"$f":"VLOOKUP(A54,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are all components of the BCP reviewed at least annually and updated as needed to reflect change? "},"CSC 10",null,"17.1.2","PR.IP-9","3.12.2","AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34","BCPL-06"]
["HLBC-04",{"$f":"VLOOKUP(A55,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does your organization regularly test the failover or recovery of production environment for the purposes of BCP and continuity? "},"CSC 10",null,"17.1.3","PR.IP-9",null,"AC-5, CP-4, CP-10; NIST SP 800-34","BCPL-11"]
["Change Management",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLCH-01",{"$f":"VLOOKUP(A57,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a documented and currently followed change management process (CMP) for standard and emergency changes? "},"CSC 10",null,"12.1.2","PR.IP-3","3.4.3, 3.4.4","CM-3, CM-4, CM-5","CHNG-01"]
["HLCH-02",{"$f":"VLOOKUP(A58,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Will the district be notified of  changes to your environment that could impact the district's security posture or service availability?"},"CSC 10",null,"12.1.2",null,null,"CM-3, CM-4, CM-5","CHNG-03"]
["HLCH-03",{"$f":"VLOOKUP(A59,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have policy and procedure, currently implemented, guiding how known vulnerabilities and zero day attack risks are mitigated until patches are available and applied?"},"CSC 13","§164.308(a)(1)(ii)(B)","12.6.1",null,null,"CM-3, CM-4, CM-5","CHNG-13"]
["Data",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLDA-01",{"$f":"VLOOKUP(A61,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you  logically separate institution's data from that of other customers?"},"CSC 12",null,null,"PR.AC-2, PR.IP-5","3.1.3, 3.8.1","AC-4, MP-2, MP-4","DATA-02"]
["HLDA-02",{"$f":"VLOOKUP(A62,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is sensitive data encrypted in transport? (e.g. system-to-client)"},"CSC 13",null,"8.2.3, 10.1.1","PR.DS-1, PR.DS-2","3.1.19, 3.8.1","MP-2, AC-19(5)","DATA-04"]
["HLDA-03",{"$f":"VLOOKUP(A63,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)?"},"CSC 13",null,"8.2.3, 10.1.1","PR.DS-1","3.1.19, 3.8.1","MP-2, AC-19(5)"]
["HLDA-04",{"$f":"VLOOKUP(A64,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do backups containing institution data ever leave the United States, either physically or via network routing?"},"CSC 13",null,"12.3.1",null,"3.8.9","CP-9, MP-5","DATA-25"]
["HLDA-05",{"$f":"VLOOKUP(A65,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures?"},"CSC 13",null,"8.3.1","PR.DS-3","3.7.1, 3.7.2, 3.8.3","CP-9 MP-6, NIST SP 800-60, NIST SP 800-88, AC-2, AC-6, IA-4, PM-2, PM-10, SI-5, MA-2, MA-3, MP-6","DATA-26"]
["HLDA-06",{"$f":"VLOOKUP(A66,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is any institution data visible in system administration modules/tools?"},"CSC 13, CSC 14",null,"14.2.5","PR.AC-4",null,null,"DATA-31"]
["Database",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLDB-01",{"$f":"VLOOKUP(A68,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does the database implement encryption of specified data elements in storage consistent with current encryption standards?"},"CSC 13",null,"10.1.1","PR.DS-1",null,null,"DBAS-01"]
["Datacenter",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLDC-01",{"$f":"VLOOKUP(A70,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Will any institution data leave the United States?"},"CSC 12",null,"11.2.1",{"$nulls":3},"DCTR-10"]
["HLDC-02",{"$f":"VLOOKUP(A71,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does your company own the physical data center where the institution's data will reside?"},"CSC 14",null,"11.1.1","PR.AC-2, PR.IP-5",null,null,"DCTR-01"]
["HLDC-03",{"$f":"VLOOKUP(A72,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does the hosting provider have a SOC 2 Type 2 report available?"},"CSC 13",null,"11.1.1",{"$nulls":3},"DCTR-02"]
["Disaster Recovery Plan",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLDR-01",{"$f":"VLOOKUP(A74,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a Disaster Recovery Plan (DRP)?"},"CSC 10",null,"17.1.1","PR.IP-9","3.12.2","AC-5, CP-4, CP-10, NIST SP 800-34","DRPL-01"]
["HLDR-02",{"$f":"VLOOKUP(A75,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are any disaster recovery locations outside the institution's of the United States?"},"CSC 10, CSC 12",null,"17.1.1","PR.IP-9",null,"AC-5, CP-4, CP-10, NIST SP 800-34","DRPL-04"]
["HLDR-03",{"$f":"VLOOKUP(A76,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are all components of the DRP reviewed at least annually and updated as needed to reflect change? "},"CSC 10",null,"17.1.1","PR.IP-9","3.12.2","AC-5, CP-4, CP-10, NIST SP 800-34","DRPL-13"]
["Firewalls, IDS, IPS, and Networking",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLFI-01",{"$f":"VLOOKUP(A78,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are you utilizing a web application firewall (WAF) and/or a stateful packet inspection (SPI) firewall?"},"CSC 9",null,"13.1.1","PR.DS-5",null,null,"FIDP-01"]
["HLFI-02",{"$f":"VLOOKUP(A79,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a documented policy for firewall change requests?"},"CSC 9",null,"12.1.2","PR.AC-5",null,null,"FIDP-04"]
["HLFI-03",{"$f":"VLOOKUP(A80,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have automated  threat monitoring and notification systems enabled? (for example, SEIM, EDPM, etc.)"},"CSC 19",null,"12.4.1",null,"3.6.1, 3.14.6, 3.14.7","IR-2, IR-4, IR-9","FIDP-09"]
["HLFI-04",{"$f":"VLOOKUP(A81,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is there a 24x7x365 monitoring and response process in place for intrusions?"},"CSC 19",null,"12.4.1","DE.CM-1, DE.CM-2, DE.CM-7","3.6.1, 3.14.6, 3.14.7","IR-2, IR-4, IR-10","FIDP-10"]
["Physical Security",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLPH-01",{"$f":"VLOOKUP(A83,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does your organization have physical security controls and policies in place?"},"CSC 3",null,"11.1.1","PR.AC-2, PR.AT-5, PR.IP-5, DE.CM-2","3.8.2, 3.10.1, 3.10.2, 3.10.5, 3.10.6, 3.12.1","MP-4, PE-2, PE-5, PE-6, PE-17","PHYS-01"]
["HLPH-02",{"$f":"VLOOKUP(A84,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are employees allowed to access or transport customer data, copy or store customer data on personally owned devices, or physically remove data from the protected infrastructure of your organization? "},"CSC 13",null,"8.2.3","PR.AC-2, PR.AC-4, PR.DS-1, PR.DS-3, PR.DS-5","3.8.1, 3.8.5, 3.8.7","MP-2, MP-5, MP-7","PHYS-02"]
["Policies, Procedures, and Processes",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLPP-01",{"$f":"VLOOKUP(A86,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Can you share the organization chart, mission statement, and policies for your information security unit?"},null,null,"5.1.1","ID.GV-2","3.9.1, 3.9.2","PM-2, PM-10, SI-5, CA-5, PM-1","PPPR-01"]
["HLPP-02",{"$f":"VLOOKUP(A87,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are information security principles designed into the product lifecycle (e.g. are you incorporating and upgrading security as an essential design element)?"},"CSC 4",null,"14.2.1","PR.IP-2","3.13.2","CA-5, CM-3, PM-1, SA-15, SA-3, SA-8, SC-2","PPPR-08"]
["HLPP-03",{"$f":"VLOOKUP(A88,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a formal, documented incident response plan that covers physical and cyber incident response and defined severity levels?"},"CSC 19",null,"16.1.5","PR.IP-9","3.6.1, 3.12.2","CA-5, PM-1, IR-4, IR-5, IR-7, IR-8","PPPR-11"]
["HLPP-04",{"$f":"VLOOKUP(A89,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a documented information security policy?"},"CSC 17","§164.308(a)(1)(i)","5.1.1","ID.GV-3",null,"CA-5, PM-1","PPPR-18"]
["Systems Management & Configuration",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLSY-01",{"$f":"VLOOKUP(A91,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you employ network and administrative segmentation in the management of this service? (for example, systems supporting the service managed via a separate management network, separate administrative controls and access, etc.)"},"CSC 12",null,"13.1.1","PR.PT-4","3.1.3","AC-4","SYST-01"]
["HLSY-02",{"$f":"VLOOKUP(A92,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have standard hardened configurations for severs, appliances and mobile devices?"},"CSC 3"]
["HLSY-03",{"$f":"VLOOKUP(A93,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you encrypt company owned mobile devices?"},"CSC 13",null,"12.1.1","PR.IP-1, PR.IP-2","3.1.18, 3.7.1, 3.13.13","CM-2, CM-6, CM-3, AC-19, MA-2","SYST-04"]
["Vulnerability Scanning",null,{"$f":"$C$22","v":"CIS Critical Security Controls v6.1"},{"$f":"$D$22","v":"HIPAA"},{"$f":"$E$22","v":"ISO 27002:2013"},{"$f":"$F$22","v":"NIST Cybersecurity Framework"},{"$f":"$G$22","v":"NIST SP 800-171r1"},{"$f":"$H$22","v":"NIST SP 800-53r4"}]
["HLVU-01",{"$f":"VLOOKUP(A95,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Have your systems and applications had a third party security assessment completed in the last year?"},"CSC 4",null,"12.6.1","DE.CM-8","3.11.1, 3.11.2, 3.11.3","SI-2","VULN-02"]
["HLVU-02",{"$f":"VLOOKUP(A96,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are your applications scanned for vulnerabilities [that are remediated]?                            "},"CSC 4",null,null,"DE.CM-8","3.11.1, 3.11.2, 3.11.3","SI-2","VULN-03"]
[]
[]
["CIS Critical Security Controls v6.1",4]
["HIPAA",5]
["ISO 27002:2013",6]
["NIST Cybersecurity Framework",7]
["NIST SP 800-171r1",8]
["NIST SP 800-53r4",9]

{"sheet":"Analyst Report","index":5,"n_rows":53,"n_cols":9,"rows_kept":53,"merged":[[0,0,0,6],[1,0,1,7],[2,0,2,7],[3,0,3,7],[4,1,4,2],[4,5,4,7],[5,1,5,2],[5,5,5,7],[6,1,6,2],[6,5,6,7],[7,1,7,2],[7,5,7,7],[9,3,9,7],[29,0,29,5],[29,6,29,7],[30,1,30,2],[30,3,30,5],[30,6,30,7],[31,1,31,2],[31,3,31,5],[32,1,32,2],[32,3,32,5],[33,1,33,2],[33,3,33,5]]}
["K-12CVAT -  Analyst Report",{"$nulls":6},{"$f":"'K-12CVAT'!E1","v":"Version 3.0"}]
[]
["Instructions"]
["Step 1: Select the security framework used at your institution in cell B10. Step 2: Convert qualitative vendor responses into quantitative values, starting at cell G32. Step 3: Review converted values, ensuring full population of report. Step 4: Move to the Summary Report tab."]
["Vendor Name",{"$f":"'K-12CVAT'!C7","v":"Vendor Name"},null,null,"Product Name",{"$f":"'K-12CVAT'!C8","v":"Product Name and Version Information"}]
["Vendor Contact Name",{"$f":"'K-12CVAT'!C11","v":"Vendor Contact Name"},null,null,"Product Description",{"$f":"'K-12CVAT'!C9","v":"Brief Description of the Product"}]
["Vendor Contact Title",{"$f":"'K-12CVAT'!C12","v":"Vendor Contact Title"},null,null,"CVAT Version","Lite 3.0"]
["Vendor Email Address",{"$f":"'K-12CVAT'!C13","v":"Vendor Contact E-mail Address"},null,null,"Date Prepared",{"$f":"'K-12CVAT'!C3","v":"mm/dd/yyyy"}]
[]
["Institution's Security Framework","NIST Cybersecurity Framework",{"$f":"IF(B10=\"\",\"< - Select security framework.\",\"\")","v":""}]
[]
[null,null,"Report Sections","Max_Score","Score","Score %"]
[null,null,{"$f":"Questions!S2","v":"Documentation"},{"$f":"Questions!W2","v":100},{"$f":"Questions!V2","v":0},{"$f":"Questions!X2","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S3","v":"Company"},{"$f":"Questions!W3","v":120},{"$f":"Questions!V3","v":0},{"$f":"Questions!X3","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S4","v":"Application Security"},{"$f":"Questions!W4","v":150},{"$f":"Questions!V4","v":0},{"$f":"Questions!X4","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S5","v":"Authentication, Authorization, and Accounting"},{"$f":"Questions!W5","v":85},{"$f":"Questions!V5","v":0},{"$f":"Questions!X5","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S6","v":"Business Continuity"},{"$f":"Questions!W6","v":55},{"$f":"Questions!V6","v":0},{"$f":"Questions!X6","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S7","v":"Change Management"},{"$f":"Questions!W7","v":65},{"$f":"Questions!V7","v":0},{"$f":"Questions!X7","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S10","v":"Data"},{"$f":"Questions!W10","v":225},{"$f":"Questions!V10","v":0},{"$f":"Questions!X10","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S11","v":"Database"},{"$f":"Questions!W11","v":60},{"$f":"Questions!V11","v":0},{"$f":"Questions!X11","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S12","v":"Datacenter"},{"$f":"Questions!W12","v":120},{"$f":"Questions!V12","v":0},{"$f":"Questions!X12","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S16","v":"Disaster Recovery"},{"$f":"Questions!W16","v":70},{"$f":"Questions!V16","v":0},{"$f":"Questions!X16","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S17","v":"Firewalls, IDS, IPS, and Networking"},{"$f":"Questions!W17","v":140},{"$f":"Questions!V17","v":0},{"$f":"Questions!X17","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S18","v":"Physical Security"},{"$f":"Questions!W18","v":80},{"$f":"Questions!V18","v":0},{"$f":"Questions!X18","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S19","v":"Policies, Procedures, and Processes"},{"$f":"Questions!W19","v":160},{"$f":"Questions!V19","v":0},{"$f":"Questions!X19","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S23","v":"Systems Management & Configuration"},{"$f":"Questions!W23","v":45},{"$f":"Questions!V23","v":0},{"$f":"Questions!X23","v":{"v":0,"d":"0%"}}]
[null,null,{"$f":"Questions!S24","v":"Vulnerability Scanning"},{"$f":"Questions!W24","v":80},{"$f":"Questions!V24","v":0},{"$f":"Questions!X24","v":{"v":0,"d":"0%"}}]
[null,null,"Overall Score",{"$f":"Questions!W25","v":"F"},{"$f":"Questions!V25","v":0},{"$f":"Questions!X25","v":{"v":0,"d":"0.00%"}}]
[]
["Qualitative Questions",{"$nulls":5},"Convert Qualitative Answer to Quantitative Value"]
["ID","Question",null,"Vendor Answer",null,null,"Compliant?"]
[{"$f":"'K-12CVAT'!A30","v":"COMP-01"},{"$f":"'K-12CVAT'!B30","v":"Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships."},null,{"$f":"'K-12CVAT'!C30","v":0},null,null,"No",{"$f":"IF(G32=\"\",\"Please rate the vendor's answer\",\"\")","v":""}]
[{"$f":"'K-12CVAT'!A31","v":"COMP-02"},{"$f":"'K-12CVAT'!B31","v":"Describe how long your organization has conducted business in this product area."},null,{"$f":"'K-12CVAT'!C31","v":0},null,null,"No",""]
[{"$f":"'K-12CVAT'!A38","v":"COMP-09"},{"$f":"'K-12CVAT'!B38","v":"Use this area to share information about your environment that will assist those who are assessing your company data security program."},null,{"$f":"'K-12CVAT'!C38","v":0},null,null,"No","",{"$f":"'High Risk Non-Compliant'!J69","v":0}]
[{"$f":"'High Risk Non-Compliant'!B71","v":0},{"$f":"'High Risk Non-Compliant'!C71","v":0},{"$f":"'High Risk Non-Compliant'!D71","v":0},{"$f":"'High Risk Non-Compliant'!E71","v":0},{"$f":"'High Risk Non-Compliant'!F71","v":0},{"$f":"'High Risk Non-Compliant'!G71","v":0},{"$f":"'High Risk Non-Compliant'!H71","v":0},{"$f":"'High Risk Non-Compliant'!I71","v":0},{"$f":"'High Risk Non-Compliant'!J71","v":0}]
[{"$f":"'High Risk Non-Compliant'!B72","v":0},{"$f":"'High Risk Non-Compliant'!C72","v":0},{"$f":"'High Risk Non-Compliant'!D72","v":0},{"$f":"'High Risk Non-Compliant'!E72","v":0},{"$f":"'High Risk Non-Compliant'!F72","v":0},{"$f":"'High Risk Non-Compliant'!G72","v":0},{"$f":"'High Risk Non-Compliant'!H72","v":0},{"$f":"'High Risk Non-Compliant'!I72","v":0},{"$f":"'High Risk Non-Compliant'!J72","v":0}]
[{"$f":"'High Risk Non-Compliant'!B73","v":0},{"$f":"'High Risk Non-Compliant'!C73","v":0},{"$f":"'High Risk Non-Compliant'!D73","v":0},{"$f":"'High Risk Non-Compliant'!E73","v":0},{"$f":"'High Risk Non-Compliant'!F73","v":0},{"$f":"'High Risk Non-Compliant'!G73","v":0},{"$f":"'High Risk Non-Compliant'!H73","v":0},{"$f":"'High Risk Non-Compliant'!I73","v":0},{"$f":"'High Risk Non-Compliant'!J73","v":0}]
[{"$f":"'High Risk Non-Compliant'!B74","v":0},{"$f":"'High Risk Non-Compliant'!C74","v":0},{"$f":"'High Risk Non-Compliant'!D74","v":0},{"$f":"'High Risk Non-Compliant'!E74","v":0},{"$f":"'High Risk Non-Compliant'!F74","v":0},{"$f":"'High Risk Non-Compliant'!G74","v":0},{"$f":"'High Risk Non-Compliant'!H74","v":0},{"$f":"'High Risk Non-Compliant'!I74","v":0},{"$f":"'High Risk Non-Compliant'!J74","v":0}]
[{"$f":"'High Risk Non-Compliant'!B75","v":0},{"$f":"'High Risk Non-Compliant'!C75","v":0},{"$f":"'High Risk Non-Compliant'!D75","v":0},{"$f":"'High Risk Non-Compliant'!E75","v":0},{"$f":"'High Risk Non-Compliant'!F75","v":0},{"$f":"'High Risk Non-Compliant'!G75","v":0},{"$f":"'High Risk Non-Compliant'!H75","v":0},{"$f":"'High Risk Non-Compliant'!I75","v":0},{"$f":"'High Risk Non-Compliant'!J75","v":0}]
[{"$f":"'High Risk Non-Compliant'!B76","v":0},{"$f":"'High Risk Non-Compliant'!C76","v":0},{"$f":"'High Risk Non-Compliant'!D76","v":0},{"$f":"'High Risk Non-Compliant'!E76","v":0},{"$f":"'High Risk Non-Compliant'!F76","v":0},{"$f":"'High Risk Non-Compliant'!G76","v":0},{"$f":"'High Risk Non-Compliant'!H76","v":0},{"$f":"'High Risk Non-Compliant'!I76","v":0},{"$f":"'High Risk Non-Compliant'!J76","v":0}]
[{"$f":"'High Risk Non-Compliant'!B77","v":0},{"$f":"'High Risk Non-Compliant'!C77","v":0},{"$f":"'High Risk Non-Compliant'!D77","v":0},{"$f":"'High Risk Non-Compliant'!E77","v":0},{"$f":"'High Risk Non-Compliant'!F77","v":0},{"$f":"'High Risk Non-Compliant'!G77","v":0},{"$f":"'High Risk Non-Compliant'!H77","v":0},{"$f":"'High Risk Non-Compliant'!I77","v":0},{"$f":"'High Risk Non-Compliant'!J77","v":0}]
[{"$f":"'High Risk Non-Compliant'!B78","v":0},{"$f":"'High Risk Non-Compliant'!C78","v":0},{"$f":"'High Risk Non-Compliant'!D78","v":0},{"$f":"'High Risk Non-Compliant'!E78","v":0},{"$f":"'High Risk Non-Compliant'!F78","v":0},{"$f":"'High Risk Non-Compliant'!G78","v":0},{"$f":"'High Risk Non-Compliant'!H78","v":0},{"$f":"'High Risk Non-Compliant'!I78","v":0},{"$f":"'High Risk Non-Compliant'!J78","v":0}]
[{"$f":"'High Risk Non-Compliant'!B79","v":0},{"$f":"'High Risk Non-Compliant'!C79","v":0},{"$f":"'High Risk Non-Compliant'!D79","v":0},{"$f":"'High Risk Non-Compliant'!E79","v":0},{"$f":"'High Risk Non-Compliant'!F79","v":0},{"$f":"'High Risk Non-Compliant'!G79","v":0},{"$f":"'High Risk Non-Compliant'!H79","v":0},{"$f":"'High Risk Non-Compliant'!I79","v":0},{"$f":"'High Risk Non-Compliant'!J79","v":0}]
[{"$f":"'High Risk Non-Compliant'!B80","v":0},{"$f":"'High Risk Non-Compliant'!C80","v":0},{"$f":"'High Risk Non-Compliant'!D80","v":0},{"$f":"'High Risk Non-Compliant'!E80","v":0},{"$f":"'High Risk Non-Compliant'!F80","v":0},{"$f":"'High Risk Non-Compliant'!G80","v":0},{"$f":"'High Risk Non-Compliant'!H80","v":0},{"$f":"'High Risk Non-Compliant'!I80","v":0},{"$f":"'High Risk Non-Compliant'!J80","v":0}]
[{"$f":"'High Risk Non-Compliant'!B81","v":0},{"$f":"'High Risk Non-Compliant'!C81","v":0},{"$f":"'High Risk Non-Compliant'!D81","v":0},{"$f":"'High Risk Non-Compliant'!E81","v":0},{"$f":"'High Risk Non-Compliant'!F81","v":0},{"$f":"'High Risk Non-Compliant'!G81","v":0},{"$f":"'High Risk Non-Compliant'!H81","v":0},{"$f":"'High Risk Non-Compliant'!I81","v":0},{"$f":"'High Risk Non-Compliant'!J81","v":0}]
[{"$f":"'High Risk Non-Compliant'!B82","v":0},{"$f":"'High Risk Non-Compliant'!C82","v":0},{"$f":"'High Risk Non-Compliant'!D82","v":0},{"$f":"'High Risk Non-Compliant'!E82","v":0},{"$f":"'High Risk Non-Compliant'!F82","v":0},{"$f":"'High Risk Non-Compliant'!G82","v":0},{"$f":"'High Risk Non-Compliant'!H82","v":0},{"$f":"'High Risk Non-Compliant'!I82","v":0},{"$f":"'High Risk Non-Compliant'!J82","v":0}]
[{"$f":"'High Risk Non-Compliant'!B83","v":0},{"$f":"'High Risk Non-Compliant'!C83","v":0},{"$f":"'High Risk Non-Compliant'!D83","v":0},{"$f":"'High Risk Non-Compliant'!E83","v":0},{"$f":"'High Risk Non-Compliant'!F83","v":0},{"$f":"'High Risk Non-Compliant'!G83","v":0},{"$f":"'High Risk Non-Compliant'!H83","v":0},{"$f":"'High Risk Non-Compliant'!I83","v":0},{"$f":"'High Risk Non-Compliant'!J83","v":0}]
[{"$f":"'High Risk Non-Compliant'!B84","v":0},{"$f":"'High Risk Non-Compliant'!C84","v":0},{"$f":"'High Risk Non-Compliant'!D84","v":0},{"$f":"'High Risk Non-Compliant'!E84","v":0},{"$f":"'High Risk Non-Compliant'!F84","v":0},{"$f":"'High Risk Non-Compliant'!G84","v":0},{"$f":"'High Risk Non-Compliant'!H84","v":0},{"$f":"'High Risk Non-Compliant'!I84","v":0},{"$f":"'High Risk Non-Compliant'!J84","v":0}]
[{"$f":"'High Risk Non-Compliant'!B85","v":0},{"$f":"'High Risk Non-Compliant'!C85","v":0},{"$f":"'High Risk Non-Compliant'!D85","v":0},{"$f":"'High Risk Non-Compliant'!E85","v":0},{"$f":"'High Risk Non-Compliant'!F85","v":0},{"$f":"'High Risk Non-Compliant'!G85","v":0},{"$f":"'High Risk Non-Compliant'!H85","v":0},{"$f":"'High Risk Non-Compliant'!I85","v":0},{"$f":"'High Risk Non-Compliant'!J85","v":0}]
[{"$f":"'High Risk Non-Compliant'!B86","v":0},{"$f":"'High Risk Non-Compliant'!C86","v":0},{"$f":"'High Risk Non-Compliant'!D86","v":0},{"$f":"'High Risk Non-Compliant'!E86","v":0},{"$f":"'High Risk Non-Compliant'!F86","v":0},{"$f":"'High Risk Non-Compliant'!G86","v":0},{"$f":"'High Risk Non-Compliant'!H86","v":0},{"$f":"'High Risk Non-Compliant'!I86","v":0},{"$f":"'High Risk Non-Compliant'!J86","v":0}]
[{"$f":"'High Risk Non-Compliant'!B87","v":0},{"$f":"'High Risk Non-Compliant'!C87","v":0},{"$f":"'High Risk Non-Compliant'!D87","v":0},{"$f":"'High Risk Non-Compliant'!E87","v":0},{"$f":"'High Risk Non-Compliant'!F87","v":0},{"$f":"'High Risk Non-Compliant'!G87","v":0},{"$f":"'High Risk Non-Compliant'!H87","v":0},{"$f":"'High Risk Non-Compliant'!I87","v":0},{"$f":"'High Risk Non-Compliant'!J87","v":0}]
[{"$f":"'High Risk Non-Compliant'!B88","v":0},{"$f":"'High Risk Non-Compliant'!C88","v":0},{"$f":"'High Risk Non-Compliant'!D88","v":0},{"$f":"'High Risk Non-Compliant'!E88","v":0},{"$f":"'High Risk Non-Compliant'!F88","v":0},{"$f":"'High Risk Non-Compliant'!G88","v":0},{"$f":"'High Risk Non-Compliant'!H88","v":0},{"$f":"'High Risk Non-Compliant'!I88","v":0},{"$f":"'High Risk Non-Compliant'!J88","v":0}]
[{"$f":"'High Risk Non-Compliant'!B89","v":0},{"$f":"'High Risk Non-Compliant'!C89","v":0},{"$f":"'High Risk Non-Compliant'!D89","v":0},{"$f":"'High Risk Non-Compliant'!E89","v":0},{"$f":"'High Risk Non-Compliant'!F89","v":0},{"$f":"'High Risk Non-Compliant'!G89","v":0},{"$f":"'High Risk Non-Compliant'!H89","v":0},{"$f":"'High Risk Non-Compliant'!I89","v":0},{"$f":"'High Risk Non-Compliant'!J89","v":0}]

{"sheet":"Analyst Reference","index":6,"n_rows":99,"n_cols":6,"rows_kept":99,"merged":[[0,0,0,3],[1,0,1,3],[19,0,19,3],[20,0,20,3],[21,0,21,1],[28,0,28,1],[38,0,38,1],[47,0,47,1],[52,0,52,1],[57,0,57,1],[61,0,61,1],[68,0,68,1],[70,0,70,1],[74,0,74,1],[78,0,78,1],[83,0,83,1],[86,0,86,1],[91,0,91,1],[95,0,95,1]]}
["K-12 Community Vendor Assessment Tool (K-12CVAT) - Lite - Analyst Reference"]
{"$rows_empty":18}
["Instructions"]
["Use this reference guide to assess vendor responses in relation to your institution's environment. The context of K-12CVAT questions can change, depending on implementation specifics so these recommendations and follow-up response are not exhaustive and are meant to improve assessment and report capabilities within your institution's security/risk assessment program. \n\nAnalyst tip #1: For any answer that is deemed \"non-compliant\" by your institution, ask the vendor if there is a timeline for implementation, a sincere commitment to customer development engagement, and/or possible implementation of compensating control(s) that offsite the risks of another component.\n\nAnalyst tip #2: If a vendor's response to a follow-up inquiry is vague or seems off-point or dismissive, respond back to the vendor contact with clear expectations for a response. Responses that fail to meet expectations thereafter should be negatively assessed based on your institution's risk tolerance and the criticality of the data involved.\n\nAnalyst tip #3: The most important tip - reject a K-12CVAT from a vendor if; the vendor provides the institution with a insufficiently populated K-12CVAT; or the vendor responses are vague and/or do not answer questions directly; or significant discrepancies are found, making the K-12CVAT difficult to assess. "]
["Documentation",null,"Reason for Question","Follow-up Inquiries/Responses"]
[{"$f":"'K-12CVAT'!A23","v":"DOCU-01"},{"$f":"VLOOKUP(A23,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Have you undergone a SSAE 18 audit?"},"Standard documentation, relevant to institutions requiring a vendor to undergo SSAE 16 audits.","Follow-up inquiries for SSAE 16 content will be institution/implementation specific. "]
[{"$f":"'K-12CVAT'!A24","v":"DOCU-02"},{"$f":"VLOOKUP(A24,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?"},"Many vendors have populated a CAIQ or at least a self-assessment. Although lacking in some areas important to Higher Ed, these documents are useful for supplemental assessment.","Follow-up inquiries for CSA content will be institution/implementation specific."]
[{"$f":"'K-12CVAT'!A25","v":"DOCU-03"},{"$f":"VLOOKUP(A25,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Have you received the Cloud Security Alliance STAR certification?"},"If a vendor is STAR certified, vendor responses can theoretically be more trusted since CSA has verified their responses. Trust, but verify for yourself, as needed.","If STAR certification is important to your institution you may have specific follow-up details for documentation purposes."]
[{"$f":"'K-12CVAT'!A26","v":"DOCU-04"},{"$f":"VLOOKUP(A26,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) Please identify which one under \"additional information\""},"The details of the standard are not the focus here, it is the fact that a vendor builds their environment around a standard and that they continually evaluate and assess their security programs.","In an ideal world, a vendor will conform to an industry framework that is adopted by an institution. When this synergy does not exist, the interpretation of the vendor's responses must be interpreted in the context of the institution's environment. Follow-up inquires for industry frameworks (and levels of adoption) will be institution/implementation specific."]
[{"$f":"'K-12CVAT'!A27","v":"DOCU-05"},{"$f":"VLOOKUP(A27,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are you compliant with FISMA standards?"},"For institutions that collaborate with the United States government, FISMA compliance may be required. ","Follow-up inquiries for FISMA compliance will be institution/implementation specific. "]
[{"$f":"'K-12CVAT'!A28","v":"DOCU-06"},{"$f":"VLOOKUP(A28,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Would you sign the Student Data Privacy Consortium statement for the state in which our district is located? (https://sdpc.a4l.org/) "},"Managing and protecting institution data is the reason organizations perform security and risk assessments. Privacy policies outline how vendors will obtain, use, share, and protect institutional data and as such, should be robust in its language. Beware of vaguely worded privacy policies.","Inquire about any privacy language the vendor may have. It may not be ideal but there may be something available to assess or enough to have your legal counsel or policy/privacy professionals review."]
["Company Overview",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"}]
[{"$f":"'K-12CVAT'!A30","v":"COMP-01"},{"$f":"VLOOKUP(A30,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships."},"Defining scale of company (support, resources, skillsets), General information about the organization that may be concerning.","Follow-up responses to this one are normally unique to their response. Vague answers here usually result in some footprinting of a vendor to determine their \"reputation\"."]
[{"$f":"'K-12CVAT'!A31","v":"COMP-02"},{"$f":"VLOOKUP(A31,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Describe how long your organization has conducted business in this product area."},"We want to establish longevity of a solution and whether or not a vendor is new to the HE space.","Normally a vendor will state their overall longevity but not talk about the software/service/product under evaluation. Follow-up's includes specific questions about the origins of the software/service/product and references will be requested."]
[{"$f":"'K-12CVAT'!A32","v":"COMP-03"},{"$f":"VLOOKUP(A32,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have existing K-12 customers?"},"K23 Education is a unique vertical. A vendor's response to this question can help an analyst set the context for all vendor responses. Established and/or mature software/product/services are more likely to have current K-12 customers, and therefore understand the environment that we operate in.","A simple \"Yes\" without any references or supporting information should be questioned. Question the size of institutions that are using the software/product/service and the scope of their implementations."]
[{"$f":"'K-12CVAT'!A33","v":"COMP-04"},{"$f":"VLOOKUP(A33,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Have you had a significant cybersecurity incident that has disrupted availability for longer than 8 hours? "},"We want transparency from the vendor and an honest answer to this question, regardless of the response, is a good step in building trust. ","If a vendor says \"No\", it is taken at face value. If you organization is capable of conducting reconnaissance, it is encouraged. If a vendor has experienced a data disruption that impacted service delivery, evaluate the circumstances of the incident and what they did to restore services. "]
[{"$f":"'K-12CVAT'!A34","v":"COMP-05"},{"$f":"VLOOKUP(A34,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Have you had a security event in the last 5 years that impacted privacy, operations, data, customers, what steps did you take to handle the incident? "},"We want transparency from the vendor and an honest answer to this question, regardless of the response, is a good step in building trust. ","If a vendor says \"No\", it is taken at face value. If you organization is capable of conducting reconnaissance, it is encouraged. If a vendor has experienced a breach, evaluate the circumstance of the incident and what the vendor has done in response to the breach."]
[{"$f":"'K-12CVAT'!A35","v":"COMP-06"},{"$f":"VLOOKUP(A35,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a formal risk management and cybersecurity program in place?"},"Understanding the security program size (and capabilities) of a vendor has a significant impact on their ability to respond effectively to a security incident. The size of a vendor will determine their SO size, or lack thereof. Use the knowledge of this response when evaluating other vendor statements.","Vague responses to this question should be investigated further. Vendors without dedicated security personnel commonly have no security or security is embedded or dual-homed within operations (administrators). Ask about separation of duties, principle of least privilege, etc. - there are many ways to get additional program state information from the vendor."]
[{"$f":"'K-12CVAT'!A36","v":"COMP-07"},{"$f":"VLOOKUP(A36,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"If applicable, do you have dedicated customer support and product management? "},"Understanding the support team size (and capabilities) of a vendor has a significant impact on their ability to respond to support requests. The size of a vendor will determine the availability of trained support and product management. Use the knowledge of this response when evaluating other vendor statements.","Follow-up inquiries for vendor team strategies will be unique to your institution and may depend on the underlying infrastructures needed to support a system for your specific use case.","APPL-04"]
[{"$f":"'K-12CVAT'!A37","v":"COMP-08"},{"$f":"VLOOKUP(A37,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"If applicable, do you have dedicated software and systems development teams? "},"Understanding the development team size (and capabilities) of a vendor has a significant impact on their ability to produce and maintain code, adhering to secure coding best practices. The size of a vendor will determine their use of dedicated development teams, or lack thereof. Use the knowledge of this response when evaluating other vendor statements.","Follow-up inquiries for vendor team strategies will be unique to your institution and may depend on the underlying infrastructures needed to support a system for your specific use case."]
[{"$f":"'K-12CVAT'!A38","v":"COMP-09"},{"$f":"VLOOKUP(A38,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Use this area to share information about your environment that will assist those who are assessing your company data security program."},"For the vendors that K-12CVAT may not  cover, this gives the vendor a chance to support their other responses. Beware when this area is populated with sales hype or other non-relevant information. Thorough documentation, supporting evidence, and/or robust responses go a long way in building trust in this assessment process.","This is a freebie to help the vendor state their \"case\". If a vendor does not add anything here (or it is just sales stuff), we can assume it was filled out by a sales engineer and questions will be evaluated with higher scrutiny.","APPL-05"]
["Application/Service Security",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"},"APPL-08"]
[{"$f":"'K-12CVAT'!A40","v":"HLAP-01"},{"$f":"VLOOKUP(A40,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does you system support various permission levels (for example, role based access control) for end users?"},"Understanding access control capabilities allows us to estimate the type of maintenance efforts will be involved to manage a system. Depending on the users, concerns may or not be elevated. The value of this question is largely determined by the deployment strategy and use case of the software/product/service under review. This question is specific to end-users.","Ask the vendor to summarize the best practices to restrict/control the access given to the institution's end-users without the use of RBAC. Make sure to understand the administrative requirements/overhead introduced in the vendor's environment.","APPL-01"]
[{"$f":"'K-12CVAT'!A41","v":"HLAP-02"},{"$f":"VLOOKUP(A41,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you enforce additional security controls for privileged access users (e.g. system administrators)? "},"Managing a software/product/service may rely on various professionals to administrate a system. This question is focused on how administration, and the segregation of functions, can be implemented within the system. Securing the administration portion of a system has additional implications (e.g. logging, administration, etc.) beyond that of end-users.","Ask the vendor to summarize the best practices for securing their system(s) administratively without the use of RBAC. Make sure to understand the administrative requirements/overhead introduced in the vendor's environment.","APPL-02"]
[{"$f":"'K-12CVAT'!A42","v":"HLAP-03"},{"$f":"VLOOKUP(A42,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Can employees access protected or sensitive data remotely?"},"Telecommuting in the IT world is common - an institution should know that proper safeguards are in place, if remote access is allowed. Vendor responses vary greatly on this so confirm the context of the response if it is not clear. Many cloud services can only be managed remotely so there is often a gray area to interpret for this response.","Ask the vendor to summarize the reasoning behind this business process and request additional documentation that outlines the security controls implemented to safeguard institutional data.","APPL-03"]
[{"$f":"'K-12CVAT'!A43","v":"HLAP-04"},{"$f":"VLOOKUP(A43,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is an audit log of access maintained by the system?"},"An audit log of access maintained by the system can be an important component of accountability and ensuring that access can be accounted for. ","Ask the vendor to describe the level of auditing of access available in the system."]
[{"$f":"'K-12CVAT'!A44","v":"HLAP-05"},{"$f":"VLOOKUP(A44,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"If necessary would you be willing to share systems schematics, diagrams, data flow diagrams, etc. ? "},"Many systems can be used a variety of ways. We want these implementation type diagrams so that we can understand the \"real\" use of the product.","Additional requests for documentation are made when other parts of the K-12CVAT are insufficient. Although helpful, many vendors do not provide supporting documentation. We try to be specific with our follow-up questions so that vendors understand we are not looking for 20-50 page whitepapers (sales documentation).","APPL-04"]
[{"$f":"'K-12CVAT'!A45","v":"HLAP-06"},{"$f":"VLOOKUP(A45,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Has your system been tested for input validation errors and do you have appropriate error messaging? "},"Input validation is a secure coding best practices so confirming its implementation is normally a high priority. Error messages (to the system and user) can be used to detect abnormal use and to better protect institutional data. Depending on the criticality of data and the flow of said data, an institution's risk tolerance will be unique to their environment. ","Inquire about any planned improvements to these capabilities. Ask about their product(s) roadmap and try to understand how they prioritize security concerns in their environment.","APPL-05"]
[{"$f":"'K-12CVAT'!A46","v":"HLAP-07"},{"$f":"VLOOKUP(A46,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is district data appropriately segmented and secured from other organization's data or access and can you demonstrate through reports? "},"A vendor's response to this question can reveal a system's infrastructure quickly. Off-point responses are common here so general follow-up is often needed. Understanding how a vendor segments its customers data (or doesn't) affects various other controls, including network settings, use of encryption, access, etc.). A vendor's response here will influence potential follow-up inquiries for other K-12CVAT questions.","Ask the vendor to summarize how a data segmentation is enforced in the  environment/strategy is implemented and what compensating controls they have in place to ensure appropriate levels of confidentiality and integrity."]
[{"$f":"'K-12CVAT'!A47","v":"HLAP-08"},{"$f":"VLOOKUP(A47,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a quality multi tenancy environment with good reporting? "},"A vendor's response to this question can reveal a system's infrastructure quickly. Off-point responses are common here so general follow-up is often needed. Understanding how a vendor manages a multi tenancy environment and can report on management of data segmentation.","Ask the vendor to summarize why a multi-tenant (or other) environment/strategy is implemented and what compensating controls they have in place to ensure appropriate levels of confidentiality and integrity.","APPL-06"]
["Authentication, Authorization, and Accounting",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"}]
[{"$f":"'K-12CVAT'!A49","v":"HLAA-01"},{"$f":"VLOOKUP(A49,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have strong authentication in place including MFA and additional controls for privileged access accounts?"},"This question is primarily focused on account management capabilities that are built into a system. Although aging is not always required, a system that lacks commodity functionality may be lacking in other areas as well. Use the vendor's response to this question as a way to pivot to other questions, as needed.","The value of this question depends on your institution's policy on passwords, its use of two factor or multi factor authentication, or any number of factors. Follow-ups for this question are unique to the institution.","AAAI-01"]
[{"$f":"'K-12CVAT'!A50","v":"HLAA-02"},{"$f":"VLOOKUP(A50,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. SAMAL, OAuth, ClassLink, etc.)"},"This question is to set account management expectations for the institution. A system that can integrate with existing, vetted solutions, has its advantages and may have less administrative overhead. Also, adherence to standards here gives credit to other standards-oriented questions/responses.","If a vendor indicates that a system is standalone and cannot integrate with community standards, follow-up with maturity questions and ask about other commodity type functions or other system requirements your institution may have.","AAAI-05"]
[{"$f":"'K-12CVAT'!A51","v":"HLAA-03"},{"$f":"VLOOKUP(A51,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication?"},"System (technical and security) administration is complex and it is important to understand a system's capabilities to integrate with existing security and access systems. Having to maintain additional accounts increases overhead and may impact your institution's risk footprint.","Follow-up inquiries for system authentication will be unique to your institution (e.g. policy, infrastructure, etc.)","AAAI-12"]
[{"$f":"'K-12CVAT'!A52","v":"HLAA-04"},{"$f":"VLOOKUP(A52,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do K-12 district staff have access to audit logs that allow them to see actions and activities taken by their users?"},"Strong logging capabilities are vital to the proper management of a system. Implementing an immature system that lacks sufficient logging capabilities exposes your institution to great risk. Depending on your risk tolerance and the use case, your institution may or may not be concerned.","If a weak response is given to this answer, it is an indicator that a sales representative populated the document and response scrutiny should be increased. \nIf a vendor does not answer appropriately, a follow-up request to have the question fully-answered is appropriate.","AAAI-15"]
["Business Continuity Plan",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"},"BCPL-06"]
[{"$f":"'K-12CVAT'!A54","v":"HLBC-01"},{"$f":"VLOOKUP(A54,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a documented Business Continuity Plan (BCP)?"},"In the context of the CIA triad, this question is focused on availability and is often in need of a follow-up. Understanding the maturing of a vendor's BCP can shed light on many other aspects of a vendor's overall security state. ","A vendor may have a number of BCP elements defined so the vendor's response may not be binary. Assess the components of the plan and ask about timelines, follow-up commitments, etc. \nIf the vendor does not have a BCP, point them to https://www.sans.org/reading-room/whitepapers/recovery/business-continuity-planning-concept-operations-1653","QUAL-04"]
[{"$f":"'K-12CVAT'!A55","v":"HLBC-02"},{"$f":"VLOOKUP(A55,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is there a documented communication plan in your BCP for impacted clients?"},"Notification expectations should be set earlier in the contract/assessment process. Timelines, correspondence medium, and playbook details are all aspects to keep in mind when assessing this response.","If the vendor's response does not cover the details outlined in the reasoning, follow-up and get specific responses for each, as needed.","BCPL-05"]
[{"$f":"'K-12CVAT'!A56","v":"HLBC-03"},{"$f":"VLOOKUP(A56,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are all components of the BCP reviewed at least annually and updated as needed to reflect change? "},"It is expected that a vendor will maintain an accurate BCP to be tested at a regular interval. Any variance to this should be clearly explained. A vendor's response to this question can reveal the value that they place on testing their BCP (and possibly other aspects of their programs).","If the vendor does not have a BCP, point them to https://www.sans.org/reading-room/whitepapers/recovery/business-continuity-planning-concept-operations-1653","BCPL-06"]
[{"$f":"'K-12CVAT'!A57","v":"HLBC-04"},{"$f":"VLOOKUP(A57,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does your organization regularly test the failover or recovery of production environment for the purposes of BCP and continuity? "},"Testing a BCP is an important action that improves the efficiency and accuracy of a vendor's continuity plans. Vague responses to this question should be met with concern and appropriate follow-up, based on your institutions risk tolerance.","If the vendor does not have a BCP, point them to https://www.sans.org/reading-room/whitepapers/recovery/business-continuity-planning-concept-operations-1653","BCPL-11"]
["Change Management",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"}]
[{"$f":"'K-12CVAT'!A59","v":"HLCH-01"},{"$f":"VLOOKUP(A59,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a documented and currently followed change management process (CMP) for standard and emergency changes? "},"The lack of a Change Management program is indicative of immature program processes - answers to this question can provide insight into how well their responses (on the K-12CVAT) represent their actual environment(s).","If a weak response is given to this answer, response scrutiny should be increased. Questions about configuration management, system authority, and documentation are appropriate.","CHNG-01"]
[{"$f":"'K-12CVAT'!A60","v":"HLCH-02"},{"$f":"VLOOKUP(A60,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Will the district be notified of  changes to your environment that could impact the district's security posture or service availability?"},"Notification expectations should be set earlier in the contract/assessment process. Timelines, correspondence medium, and playbook details are all aspects to keep in mind when assessing this response.","If the vendor's response does not cover the details outlined in the reasoning, follow-up and get specific responses for each, as needed.","CHNG-03"]
[{"$f":"'K-12CVAT'!A61","v":"HLCH-03"},{"$f":"VLOOKUP(A61,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have policy and procedure, currently implemented, guiding how known vulnerabilities and zero day attack risks are mitigated until patches are available and applied?"},"New vulnerabilities are published every day and vendors have a responsibility to maintain their software(s). The fundamental nature of operation will expose some risks to the system but it is crucial that a vendor recognize their responsibilities and have a plan to implement them, when this time arrives.","Follow-up inquiries for the vendors patching practices will be institution/implementation specific.","CHNG-13"]
["Data",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"}]
[{"$f":"'K-12CVAT'!A63","v":"HLDA-01"},{"$f":"VLOOKUP(A63,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you  logically separate institution's data from that of other customers?"},"A vendor's response to this question can reveal a system's infrastructure quickly. Off-point responses are common here so general follow-up is often needed. Understanding how a vendor segments its customers data (or doesn't) affects various other controls, including network settings, use of encryption, access, etc.). A vendor's response here will influence potential follow-up inquiries for other K-12CVAT questions.","Follow-up inquiries for the vendors infrastructure will be institution/implementation specific.","DATA-01"]
[{"$f":"'K-12CVAT'!A64","v":"HLDA-02"},{"$f":"VLOOKUP(A64,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is sensitive data encrypted in transport? (e.g. system-to-client)"},"The need for encryption in transport is unique to your institution's implementation of a system. In particular, system components, architectures, and data flows, all factor into the need for this control.","Follow-up inquiries for data encryption in transport will be institution/implementation specific.","DATA-03"]
[{"$f":"'K-12CVAT'!A65","v":"HLDA-03"},{"$f":"VLOOKUP(A65,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)?"},"The need for encryption at-rest is unique to your institution's implementation of a system. In particular, system components, architectures, and data flows, all factor into the need for this control.","Follow-up inquiries for data encryption at-rest will be institution/implementation specific.","DATA-04"]
[{"$f":"'K-12CVAT'!A66","v":"HLDA-04"},{"$f":"VLOOKUP(A66,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do backups containing institution data ever leave the United States, either physically or via network routing?"},"Data exposure is a risk if sensitive data is in any way transported (physically or electronically) into a data zone that is not authorized by the institution. Depending on the criticality of data and institution policy, full control of data confidentiality may be highly valued.","Follow-up inquiries for data backup procedures/practices will be institution/implementation specific.","DATA-23"]
[{"$f":"'K-12CVAT'!A67","v":"HLDA-05"},{"$f":"VLOOKUP(A67,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures?"},"Managing media (and the data within) throughout its lifecycle is crucial to the protection of institutional data. The focus of this question is confidentiality, ensuring that media that may store institutional data is protected by well-established policy and procedure. ","Vague responses to this question should be investigated further. Ask for additional documentation and verify that procedure (and possibly training) exists to ensure proper media handling activity.","DATA-24"]
[{"$f":"'K-12CVAT'!A68","v":"HLDA-06"},{"$f":"VLOOKUP(A68,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is any institution data visible in system administration modules/tools?"},"Confidentiality is the focus of this question. Based on the capabilities of administrators (vendor), the institution may require additional safeguards to protect the confidentiality of data stored by/shared with a vendor (e.g. additional layer of encryption, etc.). ","If institutional data is visible by [vendor] system administrators, follow-up with the vendor to understand the scope of visibility, process/procedure that administrators follow, and use cases when administrators are allowed to access (view) institutional data.","DATA-29"]
["Database",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"}]
[{"$f":"'K-12CVAT'!A70","v":"HLDB-01"},{"$f":"VLOOKUP(A70,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does the database implement encryption of specified data elements in storage consistent with current encryption standards?"},"Depending on the use case, full database encryption may not always be required, or ideal. The ability to encrypt specific fields (data elements) can be advantageous to a system. Performance is sometimes an issue, based on the use case, and this granular approach to encryption provides an institution more options.","Follow-up inquiries for database field encryption will be institution/implementation specific. Questions may include a timeline for this capability, performance metrics, and/or architectures that compensate for this level of encryption granularity.","DBAS-01"]
["Datacenter",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"},"DCTR-02"]
[{"$f":"'K-12CVAT'!A72","v":"HLDC-01"},{"$f":"VLOOKUP(A72,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Will any institution data leave the United States?"},"Data exposure is a risk if sensitive data is in any way transported (physically or electronically) into a data zone that is not authorized by the institution. Depending on the criticality of data and institution policy, full control of data confidentiality may be highly valued.","Follow-up inquiries for data backup procedures/practices will be institution/implementation specific.","DCTR-09"]
[{"$f":"'K-12CVAT'!A73","v":"HLDC-02"},{"$f":"VLOOKUP(A73,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does your company own the physical data center where the institution's data will reside?"},"Data ownership, availability, and the use of third-parties are all somewhat connected to the response of this question. ","Simple responses without supporting documentation should be me with concern. Follow-up with a vendor and request supporting documentation if the answer is in any way dismissive or off-point.","DCTR-01"]
[{"$f":"'K-12CVAT'!A74","v":"HLDC-03"},{"$f":"VLOOKUP(A74,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does the hosting provider have a SOC 2 Type 2 report available?"},"This question is relative to the response above. Understanding the ownership structure of the facility that will host institutional data is important for setting availability expectations and ensure proper contract terms are in place to protect the institution due to use of third-parties. If a vendor uses a third-party vendor to provide datacenter solutions, having that vendor's SOC 2 Type 2 provides additional insight. The ability to assess these \"forth-party\" vendors is based on your institution's resources. The vendor is responsible for providing this information - ensure that they handle their vendors properly.","Follow-up inquiries for additional vendor's SOC 2 Type 2 reports will be institution/implementation specific.","DCTR-02"]
["Disaster Recovery Plan",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"},"DRPL-13"]
[{"$f":"'K-12CVAT'!A76","v":"HLDR-01"},{"$f":"VLOOKUP(A76,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a Disaster Recovery Plan (DRP)?"},"In the context of the CIA triad, this question is focused on availability and is often in need of a follow-up. Understanding the maturing of a vendor's DRP can shed light on many other aspects of a vendor's overall security state. ","A vendor may have a number of BCP elements defined so the vendor's response may not be binary. Assess the components of the plan and ask about timelines, follow-up commitments, etc. If the vendor does not have a DRP, point them to https://www.sans.org/reading-room/whitepapers/recovery/disaster-recovery-plan-1164","QUAL-05"]
[{"$f":"'K-12CVAT'!A77","v":"HLDR-02"},{"$f":"VLOOKUP(A77,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are any disaster recovery locations outside the institution's of the United States?"},"Data exposure is a risk if sensitive data is in any way transported (physically or electronically) into a data zone that is not authorized by the institution. Depending on the criticality of data and institution policy, full control of data confidentiality may be highly valued.","Follow-up inquiries for data backup procedures/practices will be institution/implementation specific.","DRPL-04"]
[{"$f":"'K-12CVAT'!A78","v":"HLDR-03"},{"$f":"VLOOKUP(A78,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are all components of the DRP reviewed at least annually and updated as needed to reflect change? "},"Testing a DRP is an important action that improves the efficiency and accuracy of a vendor's recovery plans. Vague responses to this question should be met with concern and appropriate follow-up, based on your institutions risk tolerance.","If the vendor does not have a DRP, point them to https://www.sans.org/reading-room/whitepapers/recovery/disaster-recovery-plan-1164","DRPL-12"]
["Firewalls, IDS, IPS, and Networking",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"}]
[{"$f":"'K-12CVAT'!A80","v":"HLFI-01"},{"$f":"VLOOKUP(A80,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are you utilizing a web application firewall (WAF) and/or a stateful packet inspection (SPI) firewall?"},"The use case, vendor infrastructure, and types of services offered will greatly affect the need for various firewalling devices. The focus of this question is integrity, ensuring that the systems hosting institutional data are limited in need-only communications. The use of a WAF is important in systems in which a vendor has limited access to the to code infrastructure. ","If a vendors states that they outsource their code development and do not run a Web Application Firewall (WAF), there is elevated reason for concern. Verify how code is tested, monitored, and controlled in production environments.","FIDP-01","FIDP-02"]
[{"$f":"'K-12CVAT'!A81","v":"HLFI-02"},{"$f":"VLOOKUP(A81,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a documented policy for firewall change requests?"},"In the context of the CIA triad, this question is focused on system integrity, ensuring that system changes are only executed by authorized users. Any change to a verified, known, secure environment should be carefully evaluated by stakeholders in a structured manner.","Follow-up inquiries for firewall change requests will be institution/implementation specific.","FIDP-04"]
[{"$f":"'K-12CVAT'!A82","v":"HLFI-03"},{"$f":"VLOOKUP(A82,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have automated  threat monitoring and notification systems enabled? (for example, SEIM, EDPM, etc.)"},"This question is primarily focused on the maturity of a vendor's security program. Technologies are rapidly introduced and the toolsets needed to monitor, manage, and secure them need to keep up. Vendor responses to this question can give an institution insight into the maturity and overall state of a vendor's security. ","Follow-up inquiries for NGPT monitoring will be institution/implementation specific."]
[{"$f":"'K-12CVAT'!A83","v":"HLFI-04"},{"$f":"VLOOKUP(A83,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Is there a 24x7x365 monitoring and response process in place for intrusions?"},"This question is primarily focused on the maturity of a vendor's monitoring and incident response process.  Lack of 24x7x365 monitoring indicates a risk that an incident could occur with significant lag time to response.","If the vendor states they have a 24x7x365 monitoring capability, follow up questions may be level of monitoring and expected time of response.","FIDP-09"]
["Physical Security",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"}]
[{"$f":"'K-12CVAT'!A85","v":"HLPH-01"},{"$f":"VLOOKUP(A85,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Does your organization have physical security controls and policies in place?"},"This question is primarily focused on system(s) integrity. If institutional data is stored in a system that is not physically secured from unauthorized access, the need for compensating controls is often higher. This question also encompasses office (and other) spaces used by the vendor to conduct operations. ","If a weak response is given to this answer, response scrutiny should be increased. Inquiry about the size of an organization, how it is physically deployed, how employees interact with each other and verify each others credibility. Any follow-up question related to physical integrity of institutional data is relevant here.","PHYS-01"]
[{"$f":"'K-12CVAT'!A86","v":"HLPH-02"},{"$f":"VLOOKUP(A86,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are employees allowed to access or transport customer data, copy or store customer data on personally owned devices, or physically remove data from the protected infrastructure of your organization? "},"In the context of the CIA triad, this question is focused on confidentiality. Printed documents, mobile device use, and remote access are all relevant to this question. A vendor's response to this question will provide insight into their overall business process. Vendor business activity that pose additional security risks should be met with increased concern.","Vague responses to this question should be investigated further. Ask for additional documentation and verify that procedure (and possibly training) exists to ensure proper customer data handling activity.","PPPR-08"]
["Policies, Procedures, and Processes",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"},"PPPR-11"]
[{"$f":"'K-12CVAT'!A88","v":"HLPP-01"},{"$f":"VLOOKUP(A88,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Can you share the organization chart, mission statement, and policies for your information security unit?"},"Understanding the security program size (and capabilities) of a vendor has a significant impact on their ability to respond effectively to a security incident. Vendor's will  share organizational charts and additional documentation of their security program, if needed. The point of this question is to verify vendor security program maturity or confirm other findings and/or assessments.","Vague responses to this question should be investigated further. Vendors unwilling to share additional supporting documentation decrease the trust established with other responses. ","PPPR-18"]
[{"$f":"'K-12CVAT'!A89","v":"HLPP-02"},{"$f":"VLOOKUP(A89,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are information security principles designed into the product lifecycle (e.g. are you incorporating and upgrading security as an essential design element)?"},"The adherence to secure coding best practices better positions a vendor to maintain the CIA triad. Use the knowledge of this response when evaluating other vendor statements, particularly those focused on development and the protection of communications.","If information security principles are not designed into the product lifecycle, point the vendor to OWASP's Secure Coding Practices - Quick Reference Guide at https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide","PPPR-08"]
[{"$f":"'K-12CVAT'!A90","v":"HLPP-03"},{"$f":"VLOOKUP(A90,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a formal, documented incident response plan that covers physical and cyber incident response and defined severity levels?"},"The ability for the vendor to respond effectively (and quickly) to a security incident is of the utmost importance. The size of a vendor's security office will determine their capabilities during a security incident but the incident response plan will oftentimes determine their effectiveness. Use the knowledge of this response when evaluating other vendor statements, particularly when discussing degraded operation states.","If the vendor does not have an incident response plan, point them to the NIST Computer Security Incident Handling Guide at https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final","PPPR-10"]
[{"$f":"'K-12CVAT'!A91","v":"HLPP-04"},{"$f":"VLOOKUP(A91,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have a documented information security policy?"},"A shared security [responsibility] environment is expected of vendors in today's world. Security office's cannot solely protect an institution's data. Information security, engrained in an organization, is the best case scenario for the protection of institutional data. Security awareness and practice start in a vendor's policies.","If the vendor does not have document information security policy, follow-up questions about training, company practices, awareness efforts, auditing, and system protection practices are appropriate.","PPPR-16"]
["Systems Management & Configuration",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"}]
[{"$f":"'K-12CVAT'!A93","v":"HLSY-01"},{"$f":"VLOOKUP(A93,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you employ network and administrative segmentation in the management of this service? (for example, systems supporting the service managed via a separate management network, separate administrative controls and access, etc.)"},"Management networks and end-user networks are often exclusive, with the intent of limiting access to elevated authorization tools. When a vendor states these networks are merged in operation, it should be met with elevated levels of concern. The focus of this question is to verify a common best practice in system management, allowing an institution to gain insight into a vendor's operating environment.","Verify if the vendor's practice is constrained by a technology or if it is just a best practice that is not adopted. In the case of constraints, ask for additional best practice implementation strategies that may compensate for the elevated risk(s).","SYST-01"]
[{"$f":"'K-12CVAT'!A94","v":"HLSY-02"},{"$f":"VLOOKUP(A94,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you have standard hardened configurations for severs, appliances and mobile devices?"},"In the context of the CIS Top 18, this question is focused on the limiting of risk through the use of secure configurations. ","Follow up with questions about the standard(s) to which the vendor hardens their configurations. "]
[{"$f":"'K-12CVAT'!A95","v":"HLSY-03"},{"$f":"VLOOKUP(A95,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Do you encrypt company owned mobile devices?"},"In the context of the CIA triad, this question is focused on system integrity, ensuring that system changes are only executed by authorized users. Additionally, it is expected that devices (for administrators, vendor staff, and affiliates)that are used to access the vendor's systems are properly managed and secured. ","Follow-up with a robust question set if the vendor cannot clearly state full-control of the integrity of their system(s). Questions about administrator access on end-user devices and other maintenance and patching type questions are appropriate.","VULN-03"]
["Vulnerability Scanning",null,{"$f":"$C$22","v":"Reason for Question"},{"$f":"$D$22","v":"Follow-up Inquiries/Responses"}]
[{"$f":"'K-12CVAT'!A97","v":"HLVU-01"},{"$f":"VLOOKUP(A97,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Have your systems and applications had a third party security assessment completed in the last year?"},"External verification of security controls in important when managing a system. Trust, but verify, is the focus of this question. K-12CVAT responses are taken at face-value, and verified within reason, in most cases. When a vendor can attest to, and provide externally-provided evidence supporting that attestation, it goes a long way in building trust that the vendor will appropriately protect institutional data.","If \"No\", inquiry is there has ever been a vulnerability scan. A short lapse in external assessment validity can be understood (if there is a planned assessment) but a significant time lapse or none whatsoever is cause for elevated levels of concern. Be sure that the vendor answers for both systems AND applications. Do not let good practices in one overshadow deficiencies in the other.","VULN05","VULN-02"]
[{"$f":"'K-12CVAT'!A98","v":"HLVU-02"},{"$f":"VLOOKUP(A98,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are your applications scanned for vulnerabilities [that are remediated]?                            "},"Modern technologies allow for rapid deployment of features and with them, come changes to an established code environment. The focus of this question is to verify a vendor's practice of regression testing their code and verifying that previously non-existent risks are introduced into a known, secured environment.","If \"No\", inquiry if there are plans to implement these processes. Ask the vendor to summarize their decision behind not scanning their assets for vulnerabilities. Be sure that the vendor answers for both systems AND applications. Do not let good practices in one overshadow deficiencies in the other."]
[{"$f":"'K-12CVAT'!A99","v":"HLVU-03"},{"$f":"VLOOKUP(A99,'K-12CVAT'!A$23:B$99,2,FALSE)","v":"Are your systems scanned for vulnerabilities [that are remediated]?                            "},"Modern systems require frequent patching and management.  Rapid updates of operating systems and software elements are essential to maintaining the systems.  The focus of this question is to verify a vendor's practice of patching systems timely.","If \"No\", inquiry if there are plans to implement these processes. Ask the vendor to summarize their decision behind not routinely scanning for vulnerabilities and ensuring patching levels. Be sure that the vendor answers for both systems AND applications. Do not let good practices in one overshadow deficiencies in the other."]

{"sheet":"Summary Report","index":7,"n_rows":62,"n_cols":7,"rows_kept":62,"merged":[[0,0,0,5],[0,6,0,7],[1,0,1,7],[2,1,2,2],[2,4,2,7],[3,1,3,7],[4,0,5,2],[4,3,4,4],[4,5,5,7],[27,0,27,7],[28,0,28,2],[28,3,28,7]]}
["K-12CVAT - Lite - Summary Report",{"$nulls":5},{"$f":"'K-12CVAT'!E1","v":"Version 3.0"}]
[]
["Vendor",{"$f":"'K-12CVAT'!C7","v":"Vendor Name"},null,"Product",{"$f":"'K-12CVAT'!C8","v":"Product Name and Version Information"}]
["Description",{"$f":"'K-12CVAT'!C9","v":"Brief Description of the Product"}]
[{"$nulls":3},"Overall Score:"]
[{"$nulls":3},{"$f":"Questions!X25","v":{"v":0,"d":"0%"}},{"$f":"Questions!W25","v":"F"}]
[]
[null,null,0,0.6,{"v":0.7,"d":"1"},0.8,0.9]
[null,null,0.6,0.7,{"v":0.8,"d":"1"},0.9,1]
[null,null,"F","D","C","B","A"]
[{"$f":"Questions!S2","v":"Documentation"},{"$f":"Questions!X2","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B11,$B11<=C$9),$B11,\"\")","v":""},"","","",""]
[{"$f":"Questions!S3","v":"Company"},{"$f":"Questions!X3","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B12,$B12<=C$9),$B12,\"\")","v":""},"","","",""]
[{"$f":"Questions!S4","v":"Application Security"},{"$f":"Questions!X4","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B13,$B13<=C$9),$B13,\"\")","v":""},"","","",""]
[{"$f":"Questions!S5","v":"Authentication, Authorization, and Accounting"},{"$f":"Questions!X5","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B14,$B14<=C$9),$B14,\"\")","v":""},"","","",""]
[{"$f":"Questions!S6","v":"Business Continuity"},{"$f":"Questions!X6","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B15,$B15<=C$9),$B15,\"\")","v":""},"","","",""]
[{"$f":"Questions!S7","v":"Change Management"},{"$f":"Questions!X7","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B16,$B16<=C$9),$B16,\"\")","v":""},"","","",""]
[{"$f":"Questions!S10","v":"Data"},{"$f":"Questions!X10","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B17,$B17<=C$9),$B17,\"\")","v":""},"","","",""]
[{"$f":"Questions!S11","v":"Database"},{"$f":"Questions!X11","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B18,$B18<=C$9),$B18,\"\")","v":""},"","","",""]
[{"$f":"Questions!S12","v":"Datacenter"},{"$f":"Questions!X12","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B19,$B19<=C$9),$B19,\"\")","v":""},"","","",""]
[{"$f":"Questions!S16","v":"Disaster Recovery"},{"$f":"Questions!X16","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B20,$B20<=C$9),$B20,\"\")","v":""},"","","",""]
[{"$f":"Questions!S17","v":"Firewalls, IDS, IPS, and Networking"},{"$f":"Questions!X17","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B21,$B21<=C$9),$B21,\"\")","v":""},"","","",""]
[{"$f":"Questions!S18","v":"Physical Security"},{"$f":"Questions!X18","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B22,$B22<=C$9),$B22,\"\")","v":""},"","","",""]
[{"$f":"Questions!S19","v":"Policies, Procedures, and Processes"},{"$f":"Questions!X19","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B23,$B23<=C$9),$B23,\"\")","v":""},"","","",""]
[{"$f":"Questions!S23","v":"Systems Management & Configuration"},{"$f":"Questions!X23","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B24,$B24<=C$9),$B24,\"\")","v":""},"","","",""]
[{"$f":"Questions!S24","v":"Vulnerability Scanning"},{"$f":"Questions!X24","v":{"v":0,"d":"0.00%"}},{"$f":"IF(AND(C$8<$B25,$B25<=C$9),$B25,\"\")","v":""},"","","",""]
[]
[]
["High Risk, Non-Compliant Responses"]
[{"$nulls":3},"Institution's Security Framework"]
[{"$f":"'High Risk Non-Compliant'!B4","v":"ID"},{"$f":"'High Risk Non-Compliant'!C4","v":"Question"},{"$f":"'High Risk Non-Compliant'!D4","v":"Additional Info"},{"$f":"IFERROR(VLOOKUP('Analyst Report'!B10,'Standards Crosswalk'!A98:A104,1),\"\")","v":"NIST Cybersecurity Framework"},{"$f":"VLOOKUP('Analyst Report'!B10,'Standards Crosswalk'!A98:B104,2)","v":7}]
[{"$f":"'High Risk Non-Compliant'!B5","v":"DOCU-04"},{"$f":"'High Risk Non-Compliant'!C5","v":"Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) Please identify which one under \"additional information\""},{"$f":"'High Risk Non-Compliant'!D5","v":0},{"$f":"IFERROR(IF(VLOOKUP(A31,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A31,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"N/A"},{"$f":"IFERROR(IF(D31=\"N/A\",\"N/A\",VLOOKUP(D31,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":"N/A"}]
[{"$f":"'High Risk Non-Compliant'!B6","v":"DOCU-06"},{"$f":"'High Risk Non-Compliant'!C6","v":"Would you sign the Student Data Privacy Consortium statement for the state in which our district is located? (https://sdpc.a4l.org/) "},{"$f":"'High Risk Non-Compliant'!D6","v":0},{"$f":"IFERROR(IF(VLOOKUP(A32,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A32,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"ID.GV-3"},{"$f":"IFERROR(IF(D32=\"N/A\",\"N/A\",VLOOKUP(D32,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed"}]
[{"$f":"'High Risk Non-Compliant'!B7","v":"HLAP-01"},{"$f":"'High Risk Non-Compliant'!C7","v":"Does you system support various permission levels (for example, role based access control) for end users?"},{"$f":"'High Risk Non-Compliant'!D7","v":0},{"$f":"IFERROR(IF(VLOOKUP(A33,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A33,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.AC-4"},{"$f":"IFERROR(IF(D33=\"N/A\",\"N/A\",VLOOKUP(D33,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Access permissions are managed, incorporating the principles of least privilege and separation of duties"}]
[{"$f":"'High Risk Non-Compliant'!B8","v":"HLAP-02"},{"$f":"'High Risk Non-Compliant'!C8","v":"Do you enforce additional security controls for privileged access users (e.g. system administrators)? "},{"$f":"'High Risk Non-Compliant'!D8","v":0},{"$f":"IFERROR(IF(VLOOKUP(A34,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A34,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.AC-4, PR.PT-3"},{"$f":"IFERROR(IF(D34=\"N/A\",\"N/A\",VLOOKUP(D34,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Access permissions are managed, incorporating the principles of least privilege and separation of duties;  Access to systems and assets is controlled, incorporating the principle of least functionality"}]
[{"$f":"'High Risk Non-Compliant'!B9","v":"HLAA-02"},{"$f":"'High Risk Non-Compliant'!C9","v":"Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. SAMAL, OAuth, ClassLink, etc.)"},{"$f":"'High Risk Non-Compliant'!D9","v":0},{"$f":"IFERROR(IF(VLOOKUP(A35,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A35,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.AC-1"},{"$f":"IFERROR(IF(D35=\"N/A\",\"N/A\",VLOOKUP(D35,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Identities and credentials are managed for authorized devices and users"}]
[{"$f":"'High Risk Non-Compliant'!B10","v":"HLCH-01"},{"$f":"'High Risk Non-Compliant'!C10","v":"Do you have a documented and currently followed change management process (CMP) for standard and emergency changes? "},{"$f":"'High Risk Non-Compliant'!D10","v":0},{"$f":"IFERROR(IF(VLOOKUP(A36,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A36,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.IP-3"},{"$f":"IFERROR(IF(D36=\"N/A\",\"N/A\",VLOOKUP(D36,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Configuration change control processes are in place"}]
[{"$f":"'High Risk Non-Compliant'!B11","v":"HLDA-01"},{"$f":"'High Risk Non-Compliant'!C11","v":"Do you  logically separate institution's data from that of other customers?"},{"$f":"'High Risk Non-Compliant'!D11","v":0},{"$f":"IFERROR(IF(VLOOKUP(A37,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A37,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.AC-2, PR.IP-5"},{"$f":"IFERROR(IF(D37=\"N/A\",\"N/A\",VLOOKUP(D37,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Physical access to assets is managed and protected;  Policy and regulations regarding the physical operating environment for organizational assets are met"}]
[{"$f":"'High Risk Non-Compliant'!B12","v":"HLDA-02"},{"$f":"'High Risk Non-Compliant'!C12","v":"Is sensitive data encrypted in transport? (e.g. system-to-client)"},{"$f":"'High Risk Non-Compliant'!D12","v":0},{"$f":"IFERROR(IF(VLOOKUP(A38,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A38,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.DS-1, PR.DS-2"},{"$f":"IFERROR(IF(D38=\"N/A\",\"N/A\",VLOOKUP(D38,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Data-at-rest is protected;  Data-in-transit is protected"}]
[{"$f":"'High Risk Non-Compliant'!B13","v":"HLDA-03"},{"$f":"'High Risk Non-Compliant'!C13","v":"Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)?"},{"$f":"'High Risk Non-Compliant'!D13","v":0},{"$f":"IFERROR(IF(VLOOKUP(A39,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A39,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.DS-1"},{"$f":"IFERROR(IF(D39=\"N/A\",\"N/A\",VLOOKUP(D39,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Data-at-rest is protected"}]
[{"$f":"'High Risk Non-Compliant'!B14","v":"HLDA-04"},{"$f":"'High Risk Non-Compliant'!C14","v":"Do backups containing institution data ever leave the United States, either physically or via network routing?"},{"$f":"'High Risk Non-Compliant'!D14","v":0},{"$f":"IFERROR(IF(VLOOKUP(A40,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A40,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"N/A"},{"$f":"IFERROR(IF(D40=\"N/A\",\"N/A\",VLOOKUP(D40,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":"N/A"}]
[{"$f":"'High Risk Non-Compliant'!B15","v":"HLDA-05"},{"$f":"'High Risk Non-Compliant'!C15","v":"Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures?"},{"$f":"'High Risk Non-Compliant'!D15","v":0},{"$f":"IFERROR(IF(VLOOKUP(A41,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A41,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.DS-3"},{"$f":"IFERROR(IF(D41=\"N/A\",\"N/A\",VLOOKUP(D41,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Assets are formally managed throughout removal, transfers, and disposition"}]
[{"$f":"'High Risk Non-Compliant'!B16","v":"HLDA-06"},{"$f":"'High Risk Non-Compliant'!C16","v":"Is any institution data visible in system administration modules/tools?"},{"$f":"'High Risk Non-Compliant'!D16","v":0},{"$f":"IFERROR(IF(VLOOKUP(A42,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A42,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.AC-4"},{"$f":"IFERROR(IF(D42=\"N/A\",\"N/A\",VLOOKUP(D42,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Access permissions are managed, incorporating the principles of least privilege and separation of duties"}]
[{"$f":"'High Risk Non-Compliant'!B17","v":"HLDB-01"},{"$f":"'High Risk Non-Compliant'!C17","v":"Does the database implement encryption of specified data elements in storage consistent with current encryption standards?"},{"$f":"'High Risk Non-Compliant'!D17","v":0},{"$f":"IFERROR(IF(VLOOKUP(A43,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A43,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.DS-1"},{"$f":"IFERROR(IF(D43=\"N/A\",\"N/A\",VLOOKUP(D43,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Data-at-rest is protected"}]
[{"$f":"'High Risk Non-Compliant'!B18","v":"HLDC-01"},{"$f":"'High Risk Non-Compliant'!C18","v":"Will any institution data leave the United States?"},{"$f":"'High Risk Non-Compliant'!D18","v":0},{"$f":"IFERROR(IF(VLOOKUP(A44,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A44,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"N/A"},{"$f":"IFERROR(IF(D44=\"N/A\",\"N/A\",VLOOKUP(D44,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":"N/A"}]
[{"$f":"'High Risk Non-Compliant'!B19","v":"HLDC-02"},{"$f":"'High Risk Non-Compliant'!C19","v":"Does your company own the physical data center where the institution's data will reside?"},{"$f":"'High Risk Non-Compliant'!D19","v":0},{"$f":"IFERROR(IF(VLOOKUP(A45,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A45,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.AC-2, PR.IP-5"},{"$f":"IFERROR(IF(D45=\"N/A\",\"N/A\",VLOOKUP(D45,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Physical access to assets is managed and protected;  Policy and regulations regarding the physical operating environment for organizational assets are met"}]
[{"$f":"'High Risk Non-Compliant'!B20","v":"HLDC-03"},{"$f":"'High Risk Non-Compliant'!C20","v":"Does the hosting provider have a SOC 2 Type 2 report available?"},{"$f":"'High Risk Non-Compliant'!D20","v":0},{"$f":"IFERROR(IF(VLOOKUP(A46,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A46,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"N/A"},{"$f":"IFERROR(IF(D46=\"N/A\",\"N/A\",VLOOKUP(D46,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":"N/A"}]
[{"$f":"'High Risk Non-Compliant'!B21","v":"HLDR-02"},{"$f":"'High Risk Non-Compliant'!C21","v":"Are any disaster recovery locations outside the institution's of the United States?"},{"$f":"'High Risk Non-Compliant'!D21","v":0},{"$f":"IFERROR(IF(VLOOKUP(A47,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A47,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.IP-9"},{"$f":"IFERROR(IF(D47=\"N/A\",\"N/A\",VLOOKUP(D47,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed"}]
[{"$f":"'High Risk Non-Compliant'!B22","v":"HLFI-02"},{"$f":"'High Risk Non-Compliant'!C22","v":"Do you have a documented policy for firewall change requests?"},{"$f":"'High Risk Non-Compliant'!D22","v":0},{"$f":"IFERROR(IF(VLOOKUP(A48,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A48,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.AC-5"},{"$f":"IFERROR(IF(D48=\"N/A\",\"N/A\",VLOOKUP(D48,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Network integrity is protected, incorporating network segregation where appropriate"}]
[{"$f":"'High Risk Non-Compliant'!B23","v":"HLFI-03"},{"$f":"'High Risk Non-Compliant'!C23","v":"Do you have automated  threat monitoring and notification systems enabled? (for example, SEIM, EDPM, etc.)"},{"$f":"'High Risk Non-Compliant'!D23","v":0},{"$f":"IFERROR(IF(VLOOKUP(A49,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A49,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"N/A"},{"$f":"IFERROR(IF(D49=\"N/A\",\"N/A\",VLOOKUP(D49,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":"N/A"}]
[{"$f":"'High Risk Non-Compliant'!B24","v":"HLFI-04"},{"$f":"'High Risk Non-Compliant'!C24","v":"Is there a 24x7x365 monitoring and response process in place for intrusions?"},{"$f":"'High Risk Non-Compliant'!D24","v":0},{"$f":"IFERROR(IF(VLOOKUP(A50,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A50,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"DE.CM-1, DE.CM-2, DE.CM-7"},{"$f":"IFERROR(IF(D50=\"N/A\",\"N/A\",VLOOKUP(D50,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" The network is monitored to detect potential cybersecurity events;  The physical environment is monitored to detect potential cybersecurity events;  Monitoring for unauthorized personnel, connections, devices, and software is performed"}]
[{"$f":"'High Risk Non-Compliant'!B25","v":"HLPH-01"},{"$f":"'High Risk Non-Compliant'!C25","v":"Does your organization have physical security controls and policies in place?"},{"$f":"'High Risk Non-Compliant'!D25","v":0},{"$f":"IFERROR(IF(VLOOKUP(A51,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A51,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.AC-2, PR.AT-5, PR.IP-5, DE.CM-2"},{"$f":"IFERROR(IF(D51=\"N/A\",\"N/A\",VLOOKUP(D51,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Physical access to assets is managed and protected;  Physical and information security personnel understand roles & responsibilities ;  Policy and regulations regarding the physical operating environment for organizational assets are met;  The physical environment is monitored to detect potential cybersecurity events"}]
[{"$f":"'High Risk Non-Compliant'!B26","v":"HLPH-02"},{"$f":"'High Risk Non-Compliant'!C26","v":"Are employees allowed to access or transport customer data, copy or store customer data on personally owned devices, or physically remove data from the protected infrastructure of your organization? "},{"$f":"'High Risk Non-Compliant'!D26","v":0},{"$f":"IFERROR(IF(VLOOKUP(A52,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A52,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.AC-2, PR.AC-4, PR.DS-1, PR.DS-3, PR.DS-5"},{"$f":"IFERROR(IF(D52=\"N/A\",\"N/A\",VLOOKUP(D52,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Physical access to assets is managed and protected,  Access permissions are managed, incorporating the principles of least privilege and separation of duties;  Data-at-rest is protected;  Assets are formally managed throughout removal, transfers, and disposition;  Protections against data leaks are implemented"}]
[{"$f":"'High Risk Non-Compliant'!B27","v":"HLPP-01"},{"$f":"'High Risk Non-Compliant'!C27","v":"Can you share the organization chart, mission statement, and policies for your information security unit?"},{"$f":"'High Risk Non-Compliant'!D27","v":0},{"$f":"IFERROR(IF(VLOOKUP(A53,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A53,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"ID.GV-2"},{"$f":"IFERROR(IF(D53=\"N/A\",\"N/A\",VLOOKUP(D53,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Information security roles & responsibilities are coordinated and aligned with internal roles and external partners"}]
[{"$f":"'High Risk Non-Compliant'!B28","v":"HLPP-02"},{"$f":"'High Risk Non-Compliant'!C28","v":"Are information security principles designed into the product lifecycle (e.g. are you incorporating and upgrading security as an essential design element)?"},{"$f":"'High Risk Non-Compliant'!D28","v":0},{"$f":"IFERROR(IF(VLOOKUP(A54,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A54,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.IP-2"},{"$f":"IFERROR(IF(D54=\"N/A\",\"N/A\",VLOOKUP(D54,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" A System Development Life Cycle to manage systems is implemented"}]
[{"$f":"'High Risk Non-Compliant'!B29","v":"HLPP-03"},{"$f":"'High Risk Non-Compliant'!C29","v":"Do you have a formal, documented incident response plan that covers physical and cyber incident response and defined severity levels?"},{"$f":"'High Risk Non-Compliant'!D29","v":0},{"$f":"IFERROR(IF(VLOOKUP(A55,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A55,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"PR.IP-9"},{"$f":"IFERROR(IF(D55=\"N/A\",\"N/A\",VLOOKUP(D55,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed"}]
[{"$f":"'High Risk Non-Compliant'!B30","v":"HLPP-04"},{"$f":"'High Risk Non-Compliant'!C30","v":"Do you have a documented information security policy?"},{"$f":"'High Risk Non-Compliant'!D30","v":0},{"$f":"IFERROR(IF(VLOOKUP(A56,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A56,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"ID.GV-3"},{"$f":"IFERROR(IF(D56=\"N/A\",\"N/A\",VLOOKUP(D56,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed"}]
[{"$f":"'High Risk Non-Compliant'!B31","v":"HLVU-01"},{"$f":"'High Risk Non-Compliant'!C31","v":"Have your systems and applications had a third party security assessment completed in the last year?"},{"$f":"'High Risk Non-Compliant'!D31","v":0},{"$f":"IFERROR(IF(VLOOKUP(A57,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A57,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"DE.CM-8"},{"$f":"IFERROR(IF(D57=\"N/A\",\"N/A\",VLOOKUP(D57,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Vulnerability scans are performed"}]
[{"$f":"'High Risk Non-Compliant'!B32","v":"HLVU-02"},{"$f":"'High Risk Non-Compliant'!C32","v":"Are your applications scanned for vulnerabilities [that are remediated]?                            "},{"$f":"'High Risk Non-Compliant'!D32","v":0},{"$f":"IFERROR(IF(VLOOKUP(A58,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A58,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"DE.CM-8"},{"$f":"IFERROR(IF(D58=\"N/A\",\"N/A\",VLOOKUP(D58,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":" Vulnerability scans are performed"}]
[{"$f":"'High Risk Non-Compliant'!B33","v":0},{"$f":"'High Risk Non-Compliant'!C33","v":0},{"$f":"'High Risk Non-Compliant'!D33","v":0},{"$f":"IFERROR(IF(VLOOKUP(A59,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A59,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"N/A"},{"$f":"IFERROR(IF(D59=\"N/A\",\"N/A\",VLOOKUP(D59,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":"N/A"}]
[{"$f":"'High Risk Non-Compliant'!B34","v":0},{"$f":"'High Risk Non-Compliant'!C34","v":0},{"$f":"'High Risk Non-Compliant'!D34","v":0},{"$f":"IFERROR(IF(VLOOKUP(A60,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A60,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"N/A"},{"$f":"IFERROR(IF(D60=\"N/A\",\"N/A\",VLOOKUP(D60,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":"N/A"}]
[{"$f":"'High Risk Non-Compliant'!B35","v":0},{"$f":"'High Risk Non-Compliant'!C35","v":0},{"$f":"'High Risk Non-Compliant'!D35","v":0},{"$f":"IFERROR(IF(VLOOKUP(A61,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A61,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"N/A"},{"$f":"IFERROR(IF(D61=\"N/A\",\"N/A\",VLOOKUP(D61,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":"N/A"}]
[{"$f":"'High Risk Non-Compliant'!B36","v":0},{"$f":"'High Risk Non-Compliant'!C36","v":0},{"$f":"'High Risk Non-Compliant'!D36","v":0},{"$f":"IFERROR(IF(VLOOKUP(A62,'High Risk Non-Compliant'!B:J,$E$30,FALSE)=0,\"N/A\",VLOOKUP(A62,'High Risk Non-Compliant'!B:J,$E$30,FALSE)),\"\")","v":"N/A"},{"$f":"IFERROR(IF(D62=\"N/A\",\"N/A\",VLOOKUP(D62,'Crosswalk Detail'!A:B,2,FALSE)),\"\")","v":"N/A"}]

{"sheet":"Crosswalk Detail","index":8,"n_rows":662,"n_cols":2,"rows_kept":662,"hidden":true}
["5.1.1","Policies for information security"]
["5.1.2","Review of the policies for information security"]
["6.1.1","Information security roles and responsibilities"]
["6.1.2","Segregation of duties"]
["6.1.3","Contact with authorities"]
["6.1.4","Contact with special interest groups"]
["6.1.5","Information security in project management"]
["6.2.1","Mobile device policy"]
["6.2.2","Teleworking"]
["7.1.1","Screening"]
["7.1.2","Terms and conditions of employment"]
["7.2.1","Management responsibilities"]
["7.2.2","Information security awareness, education and training"]
["7.2.3","Disciplinary process"]
["7.3.1","Termination or change of employment responsibilities"]
["8.1.1","Inventory of assets"]
["8.1.2","Ownership of assets"]
["8.1.3","Acceptable use of assets"]
["8.1.4","Return of assets"]
["8.2.1","Classification of information"]
["8.2.2","Labelling of information"]
["8.2.3","Handling of assets"]
["8.3.1","Management of removable media"]
["8.3.2","Disposal of media"]
["8.3.3","Physical media transfer"]
["9.1.1","Access control policy"]
["9.1.2","Access to networks and network services"]
["9.2.1","User registration and de-registration"]
["9.2.2","User access provisioning"]
["9.2.3","Management of privileged access rights"]
["9.2.4","Management of secret authentication information of users"]
["9.2.5","Review of user access rights"]
["9.2.6","Removal or adjustment of access rights"]
["9.3.1","Use of secret authentication information"]
["9.4.1","Information access restriction"]
["9.4.2","Secure log-on procedures"]
["9.4.3","Password management system"]
["9.4.4","Use of privileged utility programs"]
["9.4.5","Access control to program source code"]
["10.1.1","Policy on the use of cryptographic controls"]
["10.1.2","Key management"]
["11.1.1","Physical security perimeter"]
["11.1.2","Physical entry controls"]
["11.1.3","Securing offices, rooms and facilities"]
["11.1.4","Protecting against external and environmental threats"]
["11.1.5","Working in secure areas"]
["11.1.6","Delivery and loading areas"]
["11.2.1","Equipment siting and protection"]
["11.2.2","Supporting utilities"]
["11.2.3","Cabling security"]
["11.2.4","Equipment maintenance"]
["11.2.5","Removal of assets"]
["11.2.6","Security of equipment and assets off-premises"]
["11.2.7","Secure disposal or re-use of equipment"]
["11.2.8","Unattended user equipment"]
["11.2.9","Clear desk and clear screen policy"]
["12.1.1","Documented operating procedures"]
["12.1.2","Change management"]
["12.1.3","Capacity management"]
["12.1.4","Separation of development, testing and operational environments"]
["12.2.1","Controls against malware"]
["12.3.1","Information backup"]
["12.4.1","Event logging"]
["12.4.2","Protection of log information"]
["12.4.3","Administrator and operator logs"]
["12.4.4","Clock synchronisation"]
["12.5.1","Installation of software on operational systems"]
["12.6.1","Management of technical vulnerabilities"]
["12.6.2","Restrictions on software installation"]
["12.7.1","Information systems audit controls"]
["13.1.1","Network controls "]
["13.1.2","Security of network services"]
["13.1.3","Segregation in networks"]
["13.2.1","Information transfer policies and procedures"]
["13.2.2","Agreements on information transfer"]
["13.2.3","Electronic messaging"]
["13.2.4","Confidentiality or non-disclosure agreements"]
["14.1.1","Information Security requirements analysis and specification"]
["14.1.2","Securing application services on public networks"]
["14.1.3","Protecting application services transactions"]
["14.2.1","Secure development policy"]
["14.2.2","System change control procedures"]
["14.2.3","Technical review of applications after operating platform changes"]
["14.2.4","Restrictions on changes to software packages"]
["14.2.5","Secure system engineering principles"]
["14.2.6","Secure development environment"]
["14.2.7","Outsourced development"]
["14.2.8","System security testing"]
["14.2.9","System acceptance testing"]
["14.3.1","Protection of test data"]
["15.1.1","Information security policy for supplier relationships"]
["15.1.2","Addressing security within supplier agreements"]
["15.1.3","Information and communication technology supply chain"]
["15.2.1","Monitoring and review of supplier services"]
["15.2.2","Managing changes to supplier services"]
["16.1.1","Responsibilities and procedures"]
["16.1.2","Reporting information security events"]
["16.1.3","Reporting information security weaknesses"]
["16.1.4","Assessment of and decision on information security events"]
["16.1.5","Response to information security incidents"]
["16.1.6","Learning from information security incidents"]
["16.1.7","Collection of evidence"]
["17.1.1","Planning information security continuity"]
["17.1.2","Implementing information security continuity"]
["17.1.3","Verify, review and evaluate information security continuity"]
["17.2.1","Availability of information processing facilities"]
["18.1.1","Identification of applicable legislation and contractual requirements"]
["18.1.2","Intellectual property rights"]
["18.1.3","Protection of records"]
["18.1.4","Privacy and protection of personally identifiable information"]
["18.1.5","Regulation of cryptographic controls"]
["18.2.1","Independent review of information security"]
["18.2.2","Compliance with security policies and standards"]
["18.2.3","Technical compliance review"]
["8.2.3, 10.1.1",{"$f":"CONCATENATE(B22,\"; \",B40)","v":"Handling of assets; Policy on the use of cryptographic controls"}]
["11.1.1,11.1.2",{"$f":"CONCATENATE(B42,\"; \",B43)","v":"Physical security perimeter; Physical entry controls"}]
["11.1.1, 11.1.2",{"$f":"CONCATENATE(B42,\"; \",B43)","v":"Physical security perimeter; Physical entry controls"}]
["9.2.3, 9.3.1, 9.4.3",{"$f":"CONCATENATE(B30,\"; \",B34,\"; \",B37)","v":"Management of privileged access rights; Use of secret authentication information; Password management system"}]
["9.1.1, 9.2.3, 9.3.1, 9.4.3",{"$f":"CONCATENATE(B26,\"; \",B30,\"; \",B34,\"; \",B37)","v":"Access control policy; Management of privileged access rights; Use of secret authentication information; Password management system"}]
["CSC 1","Inventory of Authorized and Unauthorized Devices"]
["CSC 2","Inventory of Authorized and Unauthorized Software"]
["CSC 3","Secure Configurations for Hardware and Software"]
["CSC 4","Continuous Vulnerability Assessment and Remediation"]
["CSC 5","Malware Defenses"]
["CSC 6","Application Software Security"]
["CSC 7","Wireless Access Control"]
["CSC 8","Data Recovery Capability"]
["CSC 9","Security Skills Assessment and Appropriate Training to Fill Gaps"]
["CSC 10","Secure Configurations for Network Devices"]
["CSC 11","Limitation and Control of Network Ports"]
["CSC 12","Controlled Use of Administrative Privileges"]
["CSC 13","Boundary Defense"]
["CSC 14","Maintenance, Monitoring, and Analysis of Audit Logs"]
["CSC 15","Controlled Access Based on the Need to Know"]
["CSC 16","Account Monitoring and Control"]
["CSC 17","Data Protection"]
["CSC 18","Incident Response and Management"]
["CSC 19","Secure Network Engineering"]
["CSC 20","Penetration Tests and Red Team Exercises"]
["CSC 13, CSC 14",{"$f":"CONCATENATE(B132,\"; \",B133)","v":"Boundary Defense; Maintenance, Monitoring, and Analysis of Audit Logs"}]
["CSC 10, CSC 12",{"$f":"CONCATENATE(B129,\"; \",B131)","v":"Secure Configurations for Network Devices; Controlled Use of Administrative Privileges"}]
["ID.AM-1"," Physical devices and systems within the organization are inventoried"]
["ID.AM-2"," Software platforms and applications within the organization are inventoried"]
["ID.AM-3"," Organizational communication and data flows are mapped"]
["ID.AM-4"," External information systems are catalogued"]
["ID.AM-5"," Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value "]
["ID.AM-6"," Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established"]
["ID.BE-1"," The organization’s role in the supply chain is identified and communicated"]
["ID.BE-2"," The organization’s place in critical infrastructure and its industry sector is identified and communicated"]
["ID.BE-3"," Priorities for organizational mission, objectives, and activities are established and communicated"]
["ID.BE-4"," Dependencies and critical functions for delivery of critical services are established"]
["ID.BE-5"," Resilience requirements to support delivery of critical services are established"]
["ID.GV-1"," Organizational information security policy is established"]
["ID.GV-2"," Information security roles & responsibilities are coordinated and aligned with internal roles and external partners"]
["ID.GV-3"," Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed"]
["ID.GV-4"," Governance and risk management processes address cybersecurity risks"]
["ID.RA-1"," Asset vulnerabilities are identified and documented"]
["ID.RA-2"," Threat and vulnerability information is received from information sharing forums and sources"]
["ID.RA-3"," Threats, both internal and external, are identified and documented"]
["ID.RA-4"," Potential business impacts and likelihoods are identified"]
["ID.RA-5"," Threats, vulnerabilities, likelihoods, and impacts are used to determine risk"]
["ID.RA-6"," Risk responses are identified and prioritized"]
["ID.RM-1"," Risk management processes are established, managed, and agreed to by organizational stakeholders"]
["ID.RM-2"," Organizational risk tolerance is determined and clearly expressed"]
["ID.RM-3"," The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis"]
["PR.AC-1"," Identities and credentials are managed for authorized devices and users"]
["PR.AC-2"," Physical access to assets is managed and protected"]
["PR.AC-3"," Remote access is managed"]
["PR.AC-4"," Access permissions are managed, incorporating the principles of least privilege and separation of duties"]
["PR.AC-5"," Network integrity is protected, incorporating network segregation where appropriate"]
["PR.AT-1"," All users are informed and trained "]
["PR.AT-2"," Privileged users understand roles & responsibilities "]
["PR.AT-3"," Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities "]
["PR.AT-4"," Senior executives understand roles & responsibilities "]
["PR.AT-5"," Physical and information security personnel understand roles & responsibilities "]
["PR.DS-1"," Data-at-rest is protected"]
["PR.DS-2"," Data-in-transit is protected"]
["PR.DS-3"," Assets are formally managed throughout removal, transfers, and disposition"]
["PR.DS-4"," Adequate capacity to ensure availability is maintained"]
["PR.DS-5"," Protections against data leaks are implemented"]
["PR.DS-6"," Integrity checking mechanisms are used to verify software, firmware, and information integrity"]
["PR.DS-7"," The development and testing environment(s) are separate from the production environment"]
["PR.IP-1"," A baseline configuration of information technology/industrial control systems is created and maintained"]
["PR.IP-2"," A System Development Life Cycle to manage systems is implemented"]
["PR.IP-3"," Configuration change control processes are in place"]
["PR.IP-4"," Backups of information are conducted, maintained, and tested periodically"]
["PR.IP-5"," Policy and regulations regarding the physical operating environment for organizational assets are met"]
["PR.IP-6"," Data is destroyed according to policy"]
["PR.IP-7"," Protection processes are continuously improved"]
["PR.IP-8"," Effectiveness of protection technologies is shared with appropriate parties"]
["PR.IP-9"," Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed"]
["PR.IP-10"," Response and recovery plans are tested"]
["PR.IP-11"," Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)"]
["PR.IP-12"," A vulnerability management plan is developed and implemented"]
["PR.MA-1"," Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools"]
["PR.MA-2"," Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access"]
["PR.PT-1"," Audit/log records are determined, documented, implemented, and reviewed in accordance with policy"]
["PR.PT-2"," Removable media is protected and its use restricted according to policy"]
["PR.PT-3"," Access to systems and assets is controlled, incorporating the principle of least functionality"]
["PR.PT-4"," Communications and control networks are protected"]
["DE.AE-1"," A baseline of network operations and expected data flows for users and systems is established and managed"]
["DE.AE-2"," Detected events are analyzed to understand attack targets and methods"]
["DE.AE-3"," Event data are aggregated and correlated from multiple sources and sensors"]
["DE.AE-4"," Impact of events is determined"]
["DE.AE-5"," Incident alert thresholds are established"]
["DE.CM-1"," The network is monitored to detect potential cybersecurity events"]
["DE.CM-2"," The physical environment is monitored to detect potential cybersecurity events"]
["DE.CM-3"," Personnel activity is monitored to detect potential cybersecurity events"]
["DE.CM-4"," Malicious code is detected"]
["DE.CM-5"," Unauthorized mobile code is detected"]
["DE.CM-6"," External service provider activity is monitored to detect potential cybersecurity events"]
["DE.CM-7"," Monitoring for unauthorized personnel, connections, devices, and software is performed"]
["DE.CM-8"," Vulnerability scans are performed"]
["DE.DP-1"," Roles and responsibilities for detection are well defined to ensure accountability"]
["DE.DP-2"," Detection activities comply with all applicable requirements"]
["DE.DP-3"," Detection processes are tested"]
["DE.DP-4"," Event detection information is communicated to appropriate parties"]
["DE.DP-5"," Detection processes are continuously improved"]
["RS.RP-1"," Response plan is executed during or after an event"]
["RS.CO-1"," Personnel know their roles and order of operations when a response is needed"]
["RS.CO-2"," Events are reported consistent with established criteria"]
["RS.CO-3"," Information is shared consistent with response plans"]
["RS.CO-4"," Coordination with stakeholders occurs consistent with response plans"]
["RS.CO-5"," Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness "]
["RS.AN-1"," Notifications from detection systems are investigated "]
["RS.AN-2"," The impact of the incident is understood"]
["RS.AN-3"," Forensics are performed"]
["RS.AN-4"," Incidents are categorized consistent with response plans"]
["RS.MI-1"," Incidents are contained"]
["RS.MI-2"," Incidents are mitigated"]
["RS.MI-3"," Newly identified vulnerabilities are mitigated or documented as accepted risks"]
["RS.IM-1"," Response plans incorporate lessons learned"]
["RS.IM-2"," Response strategies are updated"]
["RC.RP-1"," Recovery plan is executed during or after an event"]
["RC.IM-1"," Recovery plans incorporate lessons learned"]
["RC.IM-2"," Recovery strategies are updated"]
["RC.CO-1"," Public relations are managed"]
["RC.CO-2"," Reputation after an event is repaired"]
["RC.CO-3"," Recovery activities are communicated to internal stakeholders and executive and management teams"]
["PR.AC-4, PR.PT-3",{"$f":"CONCATENATE(B169,\"; \",B199)","v":" Access permissions are managed, incorporating the principles of least privilege and separation of duties;  Access to systems and assets is controlled, incorporating the principle of least functionality"}]
["ID.AM-1, ID.AM-2, ID.AM-4",{"$f":"CONCATENATE(B142,\"; \",B143,\"; \",B144)","v":" Physical devices and systems within the organization are inventoried;  Software platforms and applications within the organization are inventoried;  Organizational communication and data flows are mapped"}]
["PR.AC-1, PR.AC-4",{"$f":"CONCATENATE(B166,\"; \",B169)","v":" Identities and credentials are managed for authorized devices and users;  Access permissions are managed, incorporating the principles of least privilege and separation of duties"}]
["PR.AC-2, PR.IP-5",{"$f":"CONCATENATE(B167,\"; \",B187)","v":" Physical access to assets is managed and protected;  Policy and regulations regarding the physical operating environment for organizational assets are met"}]
["PR.DS-1, PR.DS-2",{"$f":"CONCATENATE(B176,\"; \",B177)","v":" Data-at-rest is protected;  Data-in-transit is protected"}]
["DE.CM-1, DE.CM-2, DE.CM-7",{"$f":"CONCATENATE(B206,\"; \",B207,\"; \",B212)","v":" The network is monitored to detect potential cybersecurity events;  The physical environment is monitored to detect potential cybersecurity events;  Monitoring for unauthorized personnel, connections, devices, and software is performed"}]
["PR.AC-2, PR.AT-5, PR.IP-5, DE.CM-2",{"$f":"CONCATENATE(B167,\"; \",B175,\"; \",B187,\"; \",B207)","v":" Physical access to assets is managed and protected;  Physical and information security personnel understand roles & responsibilities ;  Policy and regulations regarding the physical operating environment for organizational assets are met;  The physical environment is monitored to detect potential cybersecurity events"}]
["PR.AC-2, PR.AC-4, PR.DS-1, PR.DS-3, PR.DS-5",{"$f":"CONCATENATE(B167,\", \",B169,\"; \",B176,\"; \",B178,\"; \",B180)","v":" Physical access to assets is managed and protected,  Access permissions are managed, incorporating the principles of least privilege and separation of duties;  Data-at-rest is protected;  Assets are formally managed throughout removal, transfers, and disposition;  Protections against data leaks are implemented"}]
["PR.IP-1, PR.IP-2",{"$f":"CONCATENATE(B183,\"; \",B184)","v":" A baseline configuration of information technology/industrial control systems is created and maintained;  A System Development Life Cycle to manage systems is implemented"}]
["3.1.1","Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)."]
["3.1.2","Limit system access to the types of transactions and functions that authorized users are permitted to execute."]
["3.1.3","Control the flow of CUI in accordance with approved authorizations."]
["3.1.4","Separate the duties of individuals to reduce the risk of malevolent activity without collusion."]
["3.1.5","Employ the principle of least privilege, including for specific security functions and privileged accounts."]
["3.1.6","Use non-privileged accounts or roles when accessing nonsecurity functions."]
["3.1.7","Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs."]
["3.1.8","Limit unsuccessful logon attempts."]
["3.1.9","Provide privacy and security notices consistent with applicable CUI rules."]
["3.1.10","Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity."]
["3.1.11","Terminate (automatically) a user session after a defined condition."]
["3.1.12","Monitor and control remote access sessions."]
["3.1.13","Employ cryptographic mechanisms to protect the confidentiality of remote access sessions."]
["3.1.14","Route remote access via managed access control points."]
["3.1.15","Authorize remote execution of privileged commands and remote access to security-relevant information"]
["3.1.16","Authorize wireless access prior to allowing such connections."]
["3.1.17","Protect wireless access using authentication and encryption."]
["3.1.18","Control connection of mobile devices."]
["3.1.19","Encrypt CUI on mobile devices and mobile computing platforms.21"]
["3.1.20","Verify and control/limit connections to and use of external systems."]
["3.1.21","Limit use of portable storage devices on external systems."]
["3.1.22","Control CUI posted or processed on publicly accessible systems."]
["3.2.1","Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems."]
["3.2.2","Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities."]
["3.2.3","Provide security awareness training on recognizing and reporting potential indicators of insider reat."]
["3.3.1","Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity."]
["3.3.2","Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions."]
["3.3.3","Review and update logged events."]
["3.3.4","Alert in the event of an audit logging process failure."]
["3.3.5","Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity."]
["3.3.6","Provide audit record reduction and report generation to support on-demand analysis and reporting."]
["3.3.7","Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records."]
["3.3.8","Protect audit information and audit logging tools from unauthorized access, modification, and deletion."]
["3.3.9","Limit management of audit logging functionality to a subset of privileged users."]
["3.4.1","Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles."]
["3.4.2","Establish and enforce security configuration settings for information technology products employed in organizational systems."]
["3.4.3","Track, review, approve or disapprove, and log changes to organizational systems."]
["3.4.4","Analyze the security impact of changes prior to implementation."]
["3.4.5","Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems."]
["3.4.6","Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities."]
["3.4.7","Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services."]
["3.4.8","Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software."]
["3.4.9","Control and monitor user-installed software."]
["3.5.1","Identify system users, processes acting on behalf of users, and devices."]
["3.5.2","Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems."]
["3.5.3","Use multifactor authentication 22 for local and network access 23 to privileged accounts and for network access to non-privileged accounts."]
["3.5.4","Employ replay-resistant authentication mechanisms for network access to privileged and non- privileged accounts."]
["3.5.5","Prevent reuse of identifiers for a defined period."]
["3.5.6","Disable identifiers after a defined period of inactivity."]
["3.5.7","Enforce a minimum password complexity and change of characters when new passwords are created."]
["3.5.8","Prohibit password reuse for a specified number of generations."]
["3.5.9","Allow temporary password use for system logons with an immediate change to a permanent password."]
["3.5.10","Store and transmit only cryptographically-protected passwords."]
["3.5.11","Obscure feedback of authentication information."]
["3.6.1","Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities."]
["3.6.2","Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization."]
["3.6.3","Test the organizational incident response capability."]
["3.7.1","Perform maintenance on organizational systems."]
["3.7.2","Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance."]
["3.7.3","Ensure equipment removed for off-site maintenance is sanitized of any CUI."]
["3.7.4","Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems."]
["3.7.5","Require multifactor authentication to establish nonlocal maintenance sessions via external netw connections and terminate such connections when nonlocal maintenance is complete."]
["3.7.6","Supervise the maintenance activities of maintenance personnel without required access authorization."]
["3.8.1","Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital."]
["3.8.2","Limit access to CUI on system media to authorized users."]
["3.8.3","Sanitize or destroy system media containing CUI before disposal or release for reuse."]
["3.8.4","Mark media with necessary CUI markings and distribution limitations. "]
["3.8.5","Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas."]
["3.8.6","Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards."]
["3.8.7","Control the use of removable media on system components."]
["3.8.8","Prohibit the use of portable storage devices when such devices have no identifiable owner."]
["3.8.9","Protect the confidentiality of backup CUI at storage locations."]
["3.9.1","Screen individuals prior to authorizing access to organizational systems containing CUI."]
["3.9.2","Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers."]
["3.10.1","Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals."]
["3.10.2","Protect and monitor the physical facility and support infrastructure for organizational systems."]
["3.10.3","Escort visitors and monitor visitor activity."]
["3.10.4","Maintain audit logs of physical access."]
["3.10.5","Control and manage physical access devices."]
["3.10.6","Enforce safeguarding measures for CUI at alternate work sites."]
["3.11.1","Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI."]
["3.11.2","Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified."]
["3.11.3","Remediate vulnerabilities in accordance with risk assessments."]
["3.12.1","Periodically assess the security controls in organizational systems to determine if the controls are effective in their application."]
["3.12.2","Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems."]
["3.12.3","Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls."]
["3.12.4","Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems."]
["3.13.1","Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems."]
["3.13.2","Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems."]
["3.13.3","Separate user functionality from system management functionality."]
["3.13.4","Prevent unauthorized and unintended information transfer via shared system resources."]
["3.13.5","Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks."]
["3.13.6","Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)."]
["3.13.7","Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling)."]
["3.13.8","Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards."]
["3.13.9","Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity."]
["3.13.10","Establish and manage cryptographic keys for cryptography employed in organizational systems."]
["3.13.11","Employ FIPS-validated cryptography when used to protect the confidentiality of CUI."]
["3.13.12","Prohibit remote activation 27 of collaborative computing devices and provide indication of devices in use to users present at the device."]
["3.13.13","Control and monitor the use of mobile code."]
["3.13.14","Control and monitor the use of Voice over Internet Protocol (VoIP) technologies."]
["3.13.15","Protect the authenticity of communications sessions."]
["3.13.16","Protect the confidentiality of CUI at rest."]
["3.14.1","Identify, report, and correct system flaws in a timely manner."]
["3.14.2","Provide protection from malicious code at designated locations within organizational systems."]
["3.14.3","Monitor system security alerts and advisories and take action in response."]
["3.14.4","Update malicious code protection mechanisms when new releases are available."]
["3.14.5","Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed."]
["3.14.6","Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks."]
["3.14.7","Identify unauthorized use of organizational systems."]
["3.1.1, 3.1.2, 3.1.7",{"$f":"CONCATENATE(B249,\"; \",B250,\"; \",B255)","v":"Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).; Limit system access to the types of transactions and functions that authorized users are permitted to execute.; Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs."}]
["3.1.12, 3.1.13, 3.1.14, 3.1.14, 3.1.15, 3.1.8, 3.1.20, 3.7.5, 3.8.2, 3.13.7",{"$f":"CONCATENATE(B260,\"; \",B261,\"; \",B262,\"; \",B263,\"; \",B256,\"; \",B310,\"; \",B313,\"; \",B342)","v":"Monitor and control remote access sessions.; Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.; Route remote access via managed access control points.; Authorize remote execution of privileged commands and remote access to security-relevant information; Limit unsuccessful logon attempts.; Require multifactor authentication to establish nonlocal maintenance sessions via external netw connections and terminate such connections when nonlocal maintenance is complete.; Limit access to CUI on system media to authorized users.; Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling)."}]
["3.1.7, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.3, 3.7.1, 3.7.6, 3.10.4, 3.10.5",{"$f":"CONCATENATE(B255,\"; \",B275,\"; \",B276,\"; \",B277,\"; \",B278,\"; \",B285,\"; \",B306,\"; \",B311,\";\",B326,\";\",B327)","v":"Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.; Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.; Review and update logged events.; Alert in the event of an audit logging process failure.; Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.; Track, review, approve or disapprove, and log changes to organizational systems.; Perform maintenance on organizational systems.; Supervise the maintenance activities of maintenance personnel without required access authorization.;Maintain audit logs of physical access.;Control and manage physical access devices."}]
["3.4.3, 3.4.4",{"$f":"CONCATENATE(B285,\"; \",B286)","v":"Track, review, approve or disapprove, and log changes to organizational systems.; Analyze the security impact of changes prior to implementation."}]
["3.1.3, 3.8.1",{"$f":"CONCATENATE(B251,\";\",B312)","v":"Control the flow of CUI in accordance with approved authorizations.;Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital."}]
["3.1.19, 3.8.1",{"$f":"CONCATENATE(B267,\";\",B312)","v":"Encrypt CUI on mobile devices and mobile computing platforms.21;Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital."}]
["3.7.1, 3.7.2, 3.8.3",{"$f":"CONCATENATE(B306,\";\",B307,\";\",B314)","v":"Perform maintenance on organizational systems.;Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.;Sanitize or destroy system media containing CUI before disposal or release for reuse."}]
["3.8.1, 3.8.2",{"$f":"CONCATENATE(B312,\";\",B313)","v":"Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.;Limit access to CUI on system media to authorized users."}]
["3.6.1, 3.14.6, 3.14.7",{"$f":"CONCATENATE(B303,\";\",B357,\";\",B358)","v":"Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.;Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.;Identify unauthorized use of organizational systems."}]
["3.8.2, 3.10.1, 3.10.2, 3.10.5, 3.10.6, 3.12.1",{"$f":"CONCATENATE(B313,\"; \",B323,\"; \",B324,\"; \",B327,\"; \",B328,\"; \",B332)","v":"Limit access to CUI on system media to authorized users.; Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.; Protect and monitor the physical facility and support infrastructure for organizational systems.; Control and manage physical access devices.; Enforce safeguarding measures for CUI at alternate work sites.; Periodically assess the security controls in organizational systems to determine if the controls are effective in their application."}]
["3.8.1, 3.8.5, 3.8.7",{"$f":"CONCATENATE(B312,\";\",B316,\";\",B318)","v":"Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.;Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.;Control the use of removable media on system components."}]
["3.9.1, 3.9.2",{"$f":"CONCATENATE(B321,\";\",B322)","v":"Screen individuals prior to authorizing access to organizational systems containing CUI.;Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers."}]
["3.6.1, 3.12.2",{"$f":"CONCATENATE(B303,\";\",B333)","v":"Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.;Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems."}]
["3.1.18, 3.7.1, 3.13.13",{"$f":"CONCATENATE(B266,\";\",B306,\";\",B338)","v":"Control connection of mobile devices.;Perform maintenance on organizational systems.;Separate user functionality from system management functionality."}]
["3.11.1, 3.11.2, 3.11.3",{"$f":"CONCATENATE(B329,\";\",B330,\";\",B331)","v":"Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.;Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.;Remediate vulnerabilities in accordance with risk assessments."}]
["AC-1","Access Control Policy and Procedures"]
["AC-2","Account Management"]
["AC-3","Access Enforcement"]
["AC-4","Information Flow Enforcement"]
["AC-5","Separation of Duties"]
["AC-6","Least Privilege"]
["AC-6(9)","Access Control: Auditing use of privileged functions"]
["AC-7","Unsuccessful Logon Attempts"]
["AC-8","System Use Notification"]
["AC-9","Previous Logon (Access) Notification"]
["AC-10","Concurrent Session Control"]
["AC-11","Session Lock"]
["AC-12","Session Termination"]
["AC-13","Withdrawn"]
["AC-14","Permitted Actions without Identification or Authentication"]
["AC-15","Withdrawn"]
["AC-16","Security Attributes"]
["AC-17","Remote Access"]
["AC-18","Wireless Access"]
["AC-19","Access Control for Mobile Devices"]
["AC-19(5)","Access Control: Full device / container based encryption"]
["AC-20","Use of External Information Systems"]
["AC-21","Information Sharing"]
["AC-22","Publicly Accessible Content"]
["AC-23","Data Mining Protection"]
["AC-24","Access Control Decisions"]
["AC-25","Reference Monitor"]
["AT-1","Security Awareness and Training Policy and Procedures"]
["AT-2","Security Awareness Training"]
["AT-3","Role-Based Security Training"]
["AT-4","Security Training Records"]
["AT-5","Withdrawn"]
["AU-1","Audit and Accountability Policy and Procedures"]
["AU-2","Audit Events"]
["AU-2(3)","Audit and Accountability: reviews and updates"]
["AU-3","Content of Audit Records"]
["AU-4","Audit Storage Capacity"]
["AU-5","Response to Audit Processing Failures"]
["AU-6","Audit Review, Analysis, and Reporting"]
["AU-7","Audit Reduction and Report Generation"]
["AU-8","Time Stamps"]
["AU-9","Protection of Audit Information"]
["AU-10","Non-repudiation"]
["AU-11","Audit Record Retention"]
["AU-12","Audit Generation"]
["AU-13","Monitoring for Information Disclosure"]
["AU-14","Session Audit"]
["AU-15","Alternate Audit Capability"]
["AU-16","Cross-Organizational Auditing"]
["CA-1","Security Assessment and Authorization Policies and Procedures"]
["CA-2","Security Assessments"]
["CA-3","System Interconnections"]
["CA-4","Withdrawn"]
["CA-5","Plan of Action and Milestones"]
["CA-6","Security Authorization"]
["CA-7","Continuous Monitoring"]
["CA-8","Penetration Testing"]
["CA-9","Internal System Connections"]
["CM-1","Configuration Management Policy and Procedures"]
["CM-2","Baseline Configuration"]
["CM-3","Configuration Change Control"]
["CM-4","Security Impact Analysis"]
["CM-5","Access Restrictions for Change"]
["CM-6","Configuration Settings"]
["CM-7","Least Functionality"]
["CM-8","Information System Component Inventory"]
["CM-9","Configuration Management Plan"]
["CM-10","Software Usage Restrictions"]
["CM-11","User-Installed Software"]
["CP-1","Contingency Planning Policy and Procedures"]
["CP-2","Contingency Plan"]
["CP-3","Contingency Training"]
["CP-4","Contingency Plan Testing"]
["CP-5","Withdrawn"]
["CP-6","Alternate Storage Site"]
["CP-7","Alternate Processing Site"]
["CP-8","Telecommunications Services"]
["CP-9","Information System Backup"]
["CP-10","Information System Recovery and Reconstitution"]
["CP-11","Alternate Communications Protocols"]
["CP-12","Safe Mode"]
["CP-13","Alternative Security Mechanisms"]
["IA-1","Identification and Authentication Policy and Procedures"]
["IA-2","Identification and Authentication (Organizational Users)"]
["IA-3","Device Identification and Authentication"]
["IA-4","Identifier Management"]
["IA-5","Authenticator Management"]
["IA-5(1)","Password -Based Authentication: Enforces minimum complexity"]
["IA-6","Authenticator Feedback"]
["IA-7","Cryptographic Module Authentication"]
["IA-8","Identification and Authentication (Non- Organizational Users)"]
["IA-9","Service Identification and Authentication"]
["IA-10","Adaptive Identification and Authentication"]
["IA-11","Re-authentication"]
["IR-1","Incident Response Policy and Procedures"]
["IR-2","Incident Response Training"]
["IR-3","Incident Response Testing"]
["IR-4","Incident Handling"]
["IR-5","Incident Monitoring"]
["IR-6","Incident Reporting"]
["IR-7","Incident Response Assistance"]
["IR-8","Incident Response Plan"]
["IR-9","Information Spillage Response"]
["IR-10","Integrated Information Security Analysis Team"]
["MA-1","System Maintenance Policy and Procedures"]
["MA-2","Controlled Maintenance"]
["MA-3","Maintenance Tools"]
["MA-4","Nonlocal Maintenance"]
["MA-5","Maintenance Personnel"]
["MA-6","Timely Maintenance"]
["MP-1","Media Protection Policy and Procedures"]
["MP-2","Media Access"]
["MP-3","Media Marking"]
["MP-4","Media Storage"]
["MP-5","Media Transport"]
["MP-6","Media Sanitization"]
["MP-7","Media Use"]
["MP-8","Media Downgrading"]
["PE-1","Physical and Environmental Protection Policy and Procedures"]
["PE-2","Physical Access Authorizations"]
["PE-3","Physical Access Control"]
["PE-4","Access Control for Transmission Medium"]
["PE-5","Access Control for Output Devices"]
["PE-6","Monitoring Physical Access"]
["PE-7","Withdrawn"]
["PE-8","Visitor Access Records"]
["PE-9","Power Equipment and Cabling"]
["PE-10","Emergency Shutoff"]
["PE-11","Emergency Power"]
["PE-12","Emergency Lighting"]
["PE-13","Fire Protection"]
["PE-14","Temperature and Humidity Controls"]
["PE-15","Water Damage Protection"]
["PE-16","Delivery and Removal"]
["PE-17","Alternate Work Site"]
["PE-18","Location of Information System Components"]
["PE-19","Information Leakage"]
["PE-20","Asset Monitoring and Tracking"]
["PL-1","Security Planning Policy and Procedures"]
["PL-2","System Security Plan"]
["PL-3","Withdrawn"]
["PL-4","Rules of Behavior"]
["PL-5","Withdrawn"]
["PL-6","Withdrawn"]
["PL-7","Security Concept of Operations"]
["PL-8","Information Security Architecture"]
["PL-9","Central Management"]
["PS-1","Personnel Security Policy and Procedures"]
["PS-2","Position Risk Designation"]
["PS-3","Personnel Screening"]
["PS-4","Personnel Termination"]
["PS-5","Personnel Transfer"]
["PS-6","Access Agreements"]
["PS-7","Third-Party Personnel Security"]
["PS-8","Personnel Sanctions"]
["RA-1","Risk Assessment Policy and Procedures"]
["RA-2","Security Categorization"]
["RA-3","Risk Assessment"]
["RA-4","Withdrawn"]
["RA-5","Vulnerability Scanning"]
["RA-6","Technical Surveillance Countermeasures Survey"]
["SA-1","System and Services Acquisition Policy and Procedures"]
["SA-2","Allocation of Resources"]
["SA-3","System Development Life Cycle"]
["SA-4","Acquisition Process"]
["SA-5","Information System Documentation"]
["SA-6","Withdrawn"]
["SA-7","Withdrawn"]
["SA-8","Security Engineering Principles"]
["SA-9","External Information System Services"]
["SA-10","Developer Configuration Management"]
["SA-11","Developer Security Testing and Evaluation"]
["SA-12","Supply Chain Protection"]
["SA-13","Trustworthiness"]
["SA-14","Criticality Analysis"]
["SA-15","Development Process, Standards, and Tools"]
["SA-16","Developer-Provided Training"]
["SA-17","Developer Security Architecture and Design"]
["SA-18","Tamper Resistance and Detection"]
["SA-19","Component Authenticity"]
["SA-20","Customized Development of Critical Components"]
["SA-21","Developer Screening"]
["SA-22","Unsupported System Components"]
["SC-1","System and Communications Protection Policy and Procedures"]
["SC-2","Application Partitioning"]
["SC-3","Security Function Isolation"]
["SC-4","Information in Shared Resources"]
["SC-5","Denial of Service Protection"]
["SC-6","Resource Availability"]
["SC-7","Boundary Protection"]
["SC-8","Transmission Confidentiality and Integrity"]
["SC-9","Withdrawn"]
["SC-10","Network Disconnect"]
["SC-11","Trusted Path"]
["SC-12","Cryptographic Key Establishment and Management"]
["SC-13","Cryptographic Protection"]
["SC-14","Withdrawn"]
["SC-15","Collaborative Computing Devices"]
["SC-16","Transmission of Security Attributes"]
["SC-17","Public Key Infrastructure Certificates"]
["SC-18","Mobile Code"]
["SC-19","Voice Over Internet Protocol"]
["SC-20","Secure Name /Address Resolution Service (Authoritative Source)"]
["SC-21","Secure Name /Address Resolution Service (Recursive or Caching Resolver)"]
["SC-22","Architecture and Provisioning for Name/Address Resolution Service"]
["SC-23","Session Authenticity"]
["SC-24","Fail in Known State"]
["SC-25","Thin Nodes"]
["SC-26","Honeypots"]
["SC-27","Platform-Independent Applications"]
["SC-28","Protection of Information at Rest"]
["SC-29","Heterogeneity"]
["SC-30","Concealment and Misdirection"]
["SC-31","Covert Channel Analysis"]
["SC-32","Information System Partitioning"]
["SC-33","Withdrawn"]
["SC-34","Non-Modifiable Executable Programs"]
["SC-35","Honeyclients"]
["SC-36","Distributed Processing and Storage"]
["SC-37","Out-of-Band Channels"]
["SC-38","Operations Security"]
["SC-39","Process Isolation"]
["SC-40","Wireless Link Protection"]
["SC-41","Port and I/O Device Access"]
["SC-42","Sensor Capability and Data"]
["SC-43","Usage Restrictions"]
["SC-44","Detonation Chambers"]
["SI-1","System and Information Integrity Policy and Procedures"]
["SI-2","Flaw Remediation"]
["SI-3","Malicious Code Protection"]
["SI-4","Information System Monitoring"]
["SI-5","Security Alerts, Advisories, and Directives"]
["SI-6","Security Function Verification"]
["SI-7","Software, Firmware, and Information Integrity"]
["SI-8","Spam Protection"]
["SI-9","Withdrawn"]
["SI-10","Information Input Validation"]
["SI-11","Error Handling"]
["SI-12","Information Handling and Retention"]
["SI-13","Predictable Failure Prevention"]
["SI-14","Non-Persistence"]
["SI-15","Information Output Filtering"]
["SI-16","Memory Protection"]
["SI-17","Fail-Safe Procedures"]
["PM-1","Information Security Program Plan"]
["PM-2","Senior Information Security Officer"]
["PM-3","Information Security Resources"]
["PM-4","Plan of Action and Milestones Process"]
["PM-5","Information System Inventory"]
["PM-6","Information Security Measures of Performance"]
["PM-7","Enterprise Architecture"]
["PM-8","Critical Infrastructure Plan"]
["PM-9","Risk Management Strategy"]
["PM-10","Security Authorization Process"]
["PM-11","Mission/Business Process Definition"]
["PM-12","Isider Threat Program"]
["PM-13","Information Security Workforce"]
["PM-14","Testing, Training, & Monitoring"]
["PM-15","Contacts with Security Groups and Associations"]
["PM-16","Threat Awareness Program"]
["NIST SP 800-34","Contingency Planning Guide for Federal Information Systems"]
["NIST SP 800-46","Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security"]
["NIST SP 800-60","Guide for Mapping Types of Information and Information Systems to Security Categories"]
["NIST SP 800-88","Guidelines for Media Sanitization"]
["PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9",{"$f":"CONCATENATE(B493,\"; \",B494,\"; \",B495,\"; \",B502,\"; \",B504,\"; \",B505,\"; \",B543)","v":"Physical Access Authorizations; Physical Access Control; Access Control for Transmission Medium; Emergency Power; Fire Protection; Temperature and Humidity Controls; External Information System Services"}]
["SA-3, SA-15, SC-2, PM-2, PM-10, SI-5,PM-3 ",{"$f":"CONCATENATE(B537,\"; \",B549,\"; \",B558,\"; \",B619,\"; \",B627,\"; \",B605,\"; \",B620)","v":"System Development Life Cycle; Development Process, Standards, and Tools; Application Partitioning; Senior Information Security Officer; Security Authorization Process; Security Alerts, Advisories, and Directives; Information Security Resources"}]
["AC-2, AC-3, AC-6",{"$f":"CONCATENATE(B375,\"; \",B376,\"; \",B379)","v":"Account Management; Access Enforcement; Least Privilege"}]
["AC-3, CM-7; NIST SP 800-46",{"$f":"CONCATENATE(B376,\"; \",B438,\"; \",B635)","v":"Access Enforcement; Least Functionality; Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security"}]
["CA-9, SC-4",{"$f":"CONCATENATE(B431,\"; \",B560)","v":"Internal System Connections; Information in Shared Resources"}]
["IA-2, IA-5",{"$f":"CONCATENATE(B457,\"; \",B460)","v":"Identification and Authentication (Organizational Users); Authenticator Management"}]
["AU-2(3), AU-6, AU-12, AC-6(9), CM-3, MA-2, MA-5, PE-3",{"$f":"CONCATENATE(B408,\"; \",B412,\"; \",B418,\"; \",B380,\"; \",B434,\"; \",B479,\"; \",B482,\"; \",B494)","v":"Audit and Accountability: reviews and updates; Audit Review, Analysis, and Reporting; Audit Generation; Access Control: Auditing use of privileged functions; Configuration Change Control; Controlled Maintenance; Maintenance Personnel; Physical Access Control"}]
["AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34",{"$f":"CONCATENATE(B413,\"; \",B415,\"; \",B471,\"; \",B378,\"; \",B446,\"; \", B452,\"; \",B634)","v":"Audit Reduction and Report Generation; Protection of Audit Information; Incident Handling; Separation of Duties; Contingency Plan Testing; Information System Recovery and Reconstitution; Contingency Planning Guide for Federal Information Systems"}]
["AC-5, CP-4, CP-10, NIST SP 800-34",{"$f":"CONCATENATE(B378,\"; \",B446,\"; \", B452,\"; \",B634)","v":"Separation of Duties; Contingency Plan Testing; Information System Recovery and Reconstitution; Contingency Planning Guide for Federal Information Systems"}]
["CM-3, CM-4, CM-5",{"$f":"CONCATENATE(B434,\"; \",B435,\"; \",B436)","v":"Configuration Change Control; Security Impact Analysis; Access Restrictions for Change"}]
["AC-4, MP-2, MP-4",{"$f":"CONCATENATE(B377,\"; \",B485,\"; \",B487)","v":"Information Flow Enforcement; Media Access; Media Storage"}]
["MP-2, AC-19(5)",{"$f":"CONCATENATE(B485,\"; \",B394)","v":"Media Access; Access Control: Full device / container based encryption"}]
["CP-9, MP-5",{"$f":"CONCATENATE(B451,\"; \",B488)","v":"Information System Backup; Media Transport"}]
["CP-9 MP-6, NIST SP 800-60, NIST SP 800-88, AC-2, AC-6, IA-4, PM-2, PM-10, SI-5, MA-2, MA-3, MP-6",{"$f":"CONCATENATE(B451,\"; \",B489,\"; \",B636,\"; \",B637,\"; \",B375,\"; \",B379,\"; \",B459,\"; \",B619,\"; \",B627,\"; \",B605,\"; \",B479,\"; \",B480)","v":"Information System Backup; Media Sanitization; Guide for Mapping Types of Information and Information Systems to Security Categories; Guidelines for Media Sanitization; Account Management; Least Privilege; Identifier Management; Senior Information Security Officer; Security Authorization Process; Security Alerts, Advisories, and Directives; Controlled Maintenance; Maintenance Tools"}]
["IR-2, IR-4, IR-9",{"$f":"CONCATENATE(B469,\"; \",B471,\"; \",B476)","v":"Incident Response Training; Incident Handling; Information Spillage Response"}]
["IR-2, IR-4, IR-10",{"$f":"CONCATENATE(B469,\"; \",B471,\"; \",B477)","v":"Incident Response Training; Incident Handling; Integrated Information Security Analysis Team"}]
["MP-4, PE-2, PE-5, PE-6, PE-17",{"$f":"CONCATENATE(B487,\"; \",B493,\"; \",B496,\"; \",B497,\"; \",B508)","v":"Media Storage; Physical Access Authorizations; Access Control for Output Devices; Monitoring Physical Access; Alternate Work Site"}]
["MP-2, MP-5, MP-7",{"$f":"CONCATENATE(B485,\"; \",B488,\"; \",B490)","v":"Media Access; Media Transport; Media Use"}]
["PM-2, PM-10, SI-5, CA-5, PM-1",{"$f":"CONCATENATE(B619,\"; \",B627,\"; \",B605,\"; \",B427,\"; \",B618)","v":"Senior Information Security Officer; Security Authorization Process; Security Alerts, Advisories, and Directives; Plan of Action and Milestones; Information Security Program Plan"}]
["CA-5, CM-3, PM-1, SA-15, SA-3, SA-8, SC-2",{"$f":"CONCATENATE(B427,\"; \",B434,\"; \",B618,\"; \",B549,\"; \",B537,\"; \",B542,\"; \",B558)","v":"Plan of Action and Milestones; Configuration Change Control; Information Security Program Plan; Development Process, Standards, and Tools; System Development Life Cycle; Security Engineering Principles; Application Partitioning"}]
["CA-5, PM-1, IR-4, IR-5, IR-7, IR-8",{"$f":"CONCATENATE(B427,\"; \",B618,\"; \",B459,\"; \",B460,\"; \",B463,\"; \",B464)","v":"Plan of Action and Milestones; Information Security Program Plan; Identifier Management; Authenticator Management; Cryptographic Module Authentication; Identification and Authentication (Non- Organizational Users)"}]
["CA-5, PM-1",{"$f":"CONCATENATE(B427,\"; \",B618)","v":"Plan of Action and Milestones; Information Security Program Plan"}]
["CM-2, CM-6, CM-3, AC-19, MA-2",{"$f":"CONCATENATE(B433,\"; \",B437,\"; \",B434,\"; \",B393,\"; \",B479)","v":"Baseline Configuration; Configuration Settings; Configuration Change Control; Access Control for Mobile Devices; Controlled Maintenance"}]
["§164.308(a)(1)(i)","Security management process: Implement policies and procedures to prevent, detect, contain, and correct security violations."]
["§164.308(a)(1)(ii)(B)","Has the risk management process been completed using IAW NIST Guidelines?"]

{"sheet":"High Risk Non-Compliant","index":9,"n_rows":32,"n_cols":10,"rows_kept":32,"hidden":true}
["High Risk","TRUE"]
["Compliant",0]
[]
["Order","ID","Question","Additional Info","CIS","HIPAA","ISO 27002:27013","NIST Cybersecurity Framework","NIST SP 800-171r1","NIST SP 800-53r4"]
[4,"DOCU-04","Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) Please identify which one under \"additional information\"",0,0,0,"18.1.1",0,0,"SA-9"]
[6,"DOCU-06","Would you sign the Student Data Privacy Consortium statement for the state in which our district is located? (https://sdpc.a4l.org/) ",0,0,"§164.308(a)(1)(i)","18.1.4","ID.GV-3","ID.GV-3","SA-9"]
[15,"HLAP-01","Does you system support various permission levels (for example, role based access control) for end users?",0,"CSC 14",0,"9.2.2","PR.AC-4","3.1.1, 3.1.2, 3.1.7","AC-2, AC-3, AC-6"]
[16,"HLAP-02","Do you enforce additional security controls for privileged access users (e.g. system administrators)? ",0,"CSC 16",0,"9.1.1","PR.AC-4, PR.PT-3","3.4.9","CM-11"]
[24,"HLAA-02","Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. SAMAL, OAuth, ClassLink, etc.)",0,"CSC 16",0,"9.1.1, 9.2.3, 9.3.1, 9.4.3","PR.AC-1","3.5.1","IA-2, IA-5"]
[31,"HLCH-01","Do you have a documented and currently followed change management process (CMP) for standard and emergency changes? ",0,"CSC 10",0,"12.1.2","PR.IP-3","3.4.3, 3.4.4","CM-3, CM-4, CM-5"]
[34,"HLDA-01","Do you  logically separate institution's data from that of other customers?",0,"CSC 12",0,0,"PR.AC-2, PR.IP-5","3.1.3, 3.8.1","AC-4, MP-2, MP-4"]
[35,"HLDA-02","Is sensitive data encrypted in transport? (e.g. system-to-client)",0,"CSC 13",0,"8.2.3, 10.1.1","PR.DS-1, PR.DS-2","3.1.19, 3.8.1","MP-2, AC-19(5)"]
[36,"HLDA-03","Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)?",0,"CSC 13",0,"8.2.3, 10.1.1","PR.DS-1","3.1.19, 3.8.1","MP-2, AC-19(5)"]
[37,"HLDA-04","Do backups containing institution data ever leave the United States, either physically or via network routing?",0,"CSC 13",0,"12.3.1",0,"3.8.9","CP-9, MP-5"]
[38,"HLDA-05","Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures?",0,"CSC 13",0,"8.3.1","PR.DS-3","3.7.1, 3.7.2, 3.8.3","CP-9 MP-6, NIST SP 800-60, NIST SP 800-88, AC-2, AC-6, IA-4, PM-2, PM-10, SI-5, MA-2, MA-3, MP-6"]
[39,"HLDA-06","Is any institution data visible in system administration modules/tools?",0,"CSC 13, CSC 14",0,"14.2.5","PR.AC-4",0,0]
[40,"HLDB-01","Does the database implement encryption of specified data elements in storage consistent with current encryption standards?",0,"CSC 13",0,"10.1.1","PR.DS-1",0,0]
[41,"HLDC-01","Will any institution data leave the United States?",0,"CSC 12",0,"11.2.1",0,0,0]
[42,"HLDC-02","Does your company own the physical data center where the institution's data will reside?",0,"CSC 14",0,"11.1.1","PR.AC-2, PR.IP-5",0,0]
[43,"HLDC-03","Does the hosting provider have a SOC 2 Type 2 report available?",0,"CSC 13",0,"11.1.1",0,0,0]
[45,"HLDR-02","Are any disaster recovery locations outside the institution's of the United States?",0,"CSC 10, CSC 12",0,"17.1.1","PR.IP-9",0,"AC-5, CP-4, CP-10, NIST SP 800-34"]
[48,"HLFI-02","Do you have a documented policy for firewall change requests?",0,"CSC 9",0,"12.1.2","PR.AC-5",0,0]
[49,"HLFI-03","Do you have automated  threat monitoring and notification systems enabled? (for example, SEIM, EDPM, etc.)",0,"CSC 19",0,"12.4.1",0,"3.6.1, 3.14.6, 3.14.7","IR-2, IR-4, IR-9"]
[50,"HLFI-04","Is there a 24x7x365 monitoring and response process in place for intrusions?",0,"CSC 19",0,"12.4.1","DE.CM-1, DE.CM-2, DE.CM-7","3.6.1, 3.14.6, 3.14.7","IR-2, IR-4, IR-10"]
[51,"HLPH-01","Does your organization have physical security controls and policies in place?",0,"CSC 3",0,"11.1.1","PR.AC-2, PR.AT-5, PR.IP-5, DE.CM-2","3.8.2, 3.10.1, 3.10.2, 3.10.5, 3.10.6, 3.12.1","MP-4, PE-2, PE-5, PE-6, PE-17"]
[52,"HLPH-02","Are employees allowed to access or transport customer data, copy or store customer data on personally owned devices, or physically remove data from the protected infrastructure of your organization? ",0,"CSC 13",0,"8.2.3","PR.AC-2, PR.AC-4, PR.DS-1, PR.DS-3, PR.DS-5","3.8.1, 3.8.5, 3.8.7","MP-2, MP-5, MP-7"]
[53,"HLPP-01","Can you share the organization chart, mission statement, and policies for your information security unit?",0,0,0,"5.1.1","ID.GV-2","3.9.1, 3.9.2","PM-2, PM-10, SI-5, CA-5, PM-1"]
[54,"HLPP-02","Are information security principles designed into the product lifecycle (e.g. are you incorporating and upgrading security as an essential design element)?",0,"CSC 4",0,"14.2.1","PR.IP-2","3.13.2","CA-5, CM-3, PM-1, SA-15, SA-3, SA-8, SC-2"]
[55,"HLPP-03","Do you have a formal, documented incident response plan that covers physical and cyber incident response and defined severity levels?",0,"CSC 19",0,"16.1.5","PR.IP-9","3.6.1, 3.12.2","CA-5, PM-1, IR-4, IR-5, IR-7, IR-8"]
[56,"HLPP-04","Do you have a documented information security policy?",0,"CSC 17","§164.308(a)(1)(i)","5.1.1","ID.GV-3",0,"CA-5, PM-1"]
[60,"HLVU-01","Have your systems and applications had a third party security assessment completed in the last year?",0,"CSC 4",0,"12.6.1","DE.CM-8","3.11.1, 3.11.2, 3.11.3","SI-2"]
[61,"HLVU-02","Are your applications scanned for vulnerabilities [that are remediated]?                            ",0,"CSC 4",0,0,"DE.CM-8","3.11.1, 3.11.2, 3.11.3","SI-2"]

{"sheet":"Questions","index":10,"n_rows":62,"n_cols":28,"rows_kept":62,"hidden":true}
["Order","ID","Question","Additional Info","High Risk","Required","Category","Compliant Answer","Vendor Answer","Compliant","Weight","Score","CIS","HIPAA","ISO 27002:27013","NIST Cybersecurity Framework","NIST SP 800-171r1","NIST SP 800-53r4",null,"Category_Total","Category_divisor","Score","Max_Score","Score %"]
[1,"DOCU-01",{"$f":"VLOOKUP(B2,'K-12CVAT'!A:E,2,FALSE)","v":"Have you undergone a SSAE 18 audit?"},{"$f":"VLOOKUP(B2,'K-12CVAT'!A:E,4,FALSE)","v":0},{"$f":"IF(K2>20,TRUE,FALSE)","v":false},1,"Documentation","Yes",{"$f":"VLOOKUP(B2,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},{"$f":"IF(ISNUMBER(FIND(H2,I2)), 1, 0)","v":0},15,{"$f":"J2*K2","v":0},{"$f":"VLOOKUP($B2,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B2,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B2,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"15.2.1"},{"$f":"VLOOKUP($B2,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B2,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B2,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"SA-9"},"Documentation",{"$f":"COUNTIFS(B:B,\"DOCU*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"DOCU*\")","v":6},{"$f":"SUMIFS(L:L,B:B, \"DOCU*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"DOCU*\")","v":100},{"$f":"V2/W2","v":{"v":0,"d":"0.00%"}},"High Risk Non-Compliant",{"$f":"COUNTIFS(E:E,\"TRUE\",J:J,\"<1\")","v":28},"% High Risk non-compliant",{"$f":"Z2/Z4","v":1}]
[{"$f":"A2+1","v":2},"DOCU-02",{"$f":"VLOOKUP(B3,'K-12CVAT'!A:E,2,FALSE)","v":"Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?"},{"$f":"VLOOKUP(B3,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Documentation","Yes",{"$f":"VLOOKUP(B3,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,10,0,{"$f":"VLOOKUP($B3,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B3,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B3,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"15.2.1"},{"$f":"VLOOKUP($B3,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B3,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B3,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9"},"Company",{"$f":"COUNTIFS(B:B,\"COMP*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"COMP*\")","v":8},{"$f":"SUMIFS(L:L,B:B, \"COMP*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"COMP*\")","v":120},{"v":0,"d":"0.00%"},"Low Risk Non-Compliant",{"$f":"COUNTIFS(E:E,\"FALSE\",J:J,\"<1\")","v":33},"% Low Risk non-compliant",1]
[3,"DOCU-03",{"$f":"VLOOKUP(B4,'K-12CVAT'!A:E,2,FALSE)","v":"Have you received the Cloud Security Alliance STAR certification?"},{"$f":"VLOOKUP(B4,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Documentation","Yes",{"$f":"VLOOKUP(B4,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,15,0,{"$f":"VLOOKUP($B4,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B4,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B4,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"15.2.1"},{"$f":"VLOOKUP($B4,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B4,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B4,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9"},"Application Security",{"$f":"COUNTIFS(B:B,\"HLAP*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLAP*\")","v":8},{"$f":"SUMIFS(L:L,B:B, \"HLAP*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLAP*\")","v":150},{"v":0,"d":"0.00%"},"High Risk Total",{"$f":"COUNTIF(E:E,\"TRUE\")","v":28}]
[4,"DOCU-04",{"$f":"VLOOKUP(B5,'K-12CVAT'!A:E,2,FALSE)","v":"Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) Please identify which one under \"additional information\""},{"$f":"VLOOKUP(B5,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Documentation","Yes",{"$f":"VLOOKUP(B5,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,25,0,{"$f":"VLOOKUP($B5,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B5,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B5,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"18.1.1"},{"$f":"VLOOKUP($B5,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B5,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B5,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"SA-9"},"Authentication, Authorization, and Accounting",{"$f":"COUNTIFS(B:B,\"HLAA*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLAA*\")","v":4},{"$f":"SUMIFS(L:L,B:B, \"HLAA*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLAA*\")","v":85},{"v":0,"d":"0.00%"},"Low Risk Total",{"$f":"COUNTIF(E2:E185,\"FALSE\")","v":33}]
[5,"DOCU-05",{"$f":"VLOOKUP(B6,'K-12CVAT'!A:E,2,FALSE)","v":"Are you compliant with FISMA standards?"},{"$f":"VLOOKUP(B6,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Documentation","Yes",{"$f":"VLOOKUP(B6,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,10,0,{"$f":"VLOOKUP($B6,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B6,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B6,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"18.1.1"},{"$f":"VLOOKUP($B6,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B6,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B6,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"SA-9"},"Business Continuity",{"$f":"COUNTIFS(B:B,\"HLBC*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLBC*\")","v":4},{"$f":"SUMIFS(L:L,B:B, \"HLBC*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLBC*\")","v":55},{"v":0,"d":"0.00%"}]
[6,"DOCU-06",{"$f":"VLOOKUP(B7,'K-12CVAT'!A:E,2,FALSE)","v":"Would you sign the Student Data Privacy Consortium statement for the state in which our district is located? (https://sdpc.a4l.org/) "},{"$f":"VLOOKUP(B7,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Documentation","Yes",{"$f":"VLOOKUP(B7,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,25,0,{"$f":"VLOOKUP($B7,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B7,'Standards Crosswalk'!$A:$H,4,FALSE)","v":"§164.308(a)(1)(i)"},{"$f":"VLOOKUP($B7,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"18.1.4"},{"$f":"VLOOKUP($B7,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"ID.GV-3"},{"$f":"VLOOKUP($B7,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"ID.GV-3"},{"$f":"VLOOKUP($B7,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"SA-9"},"Change Management",{"$f":"COUNTIFS(B:B,\"HLCH*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLCH*\")","v":3},{"$f":"SUMIFS(L:L,B:B, \"HLCH*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLCH*\")","v":65},{"v":0,"d":"0.00%"}]
[7,"COMP-01",{"$f":"VLOOKUP(B8,'K-12CVAT'!A:E,2,FALSE)","v":"Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships."},{"$f":"VLOOKUP(B8,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Company Overview",null,null,{"$f":"IF(VLOOKUP(B8,'Analyst Report'!A$32:G$51,7,FALSE)=\"Yes\",1,0)","v":0},10,0,{"$f":"VLOOKUP($B8,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B8,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B8,'Standards Crosswalk'!$A:$H,5,FALSE)","v":0},{"$f":"VLOOKUP($B8,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B8,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B8,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0}]
[8,"COMP-02",{"$f":"VLOOKUP(B9,'K-12CVAT'!A:E,2,FALSE)","v":"Describe how long your organization has conducted business in this product area."},{"$f":"VLOOKUP(B9,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Company Overview",null,null,{"$f":"IF(VLOOKUP(B9,'Analyst Report'!A$32:G$51,7,FALSE)=\"Yes\",1,0)","v":0},10,0,{"$f":"VLOOKUP($B9,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B9,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B9,'Standards Crosswalk'!$A:$H,5,FALSE)","v":0},{"$f":"VLOOKUP($B9,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B9,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B9,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0}]
[9,"COMP-03",{"$f":"VLOOKUP(B10,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have existing K-12 customers?"},{"$f":"VLOOKUP(B10,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Company Overview","Yes",{"$f":"VLOOKUP(B10,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},{"$f":"IF(ISNUMBER(FIND(H10,I10)), 1, 0)","v":0},15,0,{"$f":"VLOOKUP($B10,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B10,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B10,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"15.2.1"},{"$f":"VLOOKUP($B10,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B10,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B10,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0},"Data",{"$f":"COUNTIFS(B:B,\"HLDA*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLDA*\")","v":6},{"$f":"SUMIFS(L:L,B:B, \"HLDA*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLDA*\")","v":225},{"$f":"V10/W10","v":{"v":0,"d":"0.00%"}}]
[10,"COMP-04",{"$f":"VLOOKUP(B11,'K-12CVAT'!A:E,2,FALSE)","v":"Have you had a significant cybersecurity incident that has disrupted availability for longer than 8 hours? "},{"$f":"VLOOKUP(B11,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Company Overview","No",{"$f":"VLOOKUP(B11,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,20,0,{"$f":"VLOOKUP($B11,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B11,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B11,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"15.2.2"},{"$f":"VLOOKUP($B11,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B11,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B11,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0},"Database",{"$f":"COUNTIFS(B:B,\"HLDB*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLDB*\")","v":1},{"$f":"SUMIFS(L:L,B:B, \"HLDB*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLDB*\")","v":60},{"v":0,"d":"0.00%"}]
[11,"COMP-05",{"$f":"VLOOKUP(B12,'K-12CVAT'!A:E,2,FALSE)","v":"Have you had a security event in the last 5 years that impacted privacy, operations, data, customers, what steps did you take to handle the incident? "},{"$f":"VLOOKUP(B12,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Company Overview","Yes",{"$f":"VLOOKUP(B12,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,20,0,{"$f":"VLOOKUP($B12,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B12,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B12,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"15.2.1"},{"$f":"VLOOKUP($B12,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B12,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B12,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0},"Datacenter",{"$f":"COUNTIFS(B:B,\"HLDC*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLDC*\")","v":3},{"$f":"SUMIFS(L:L,B:B, \"HLDC*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLDC*\")","v":120},{"v":0,"d":"0.00%"}]
[12,"COMP-06",{"$f":"VLOOKUP(B13,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have a formal risk management and cybersecurity program in place?"},{"$f":"VLOOKUP(B13,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Company Overview","Yes",{"$f":"VLOOKUP(B13,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,15,0,{"$f":"VLOOKUP($B13,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B13,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B13,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"14.2.1"},{"$f":"VLOOKUP($B13,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B13,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B13,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"SA-3, SA-15, SC-2, PM-2, PM-10, SI-5,PM-3 "}]
[13,"COMP-07",{"$f":"VLOOKUP(B14,'K-12CVAT'!A:E,2,FALSE)","v":"If applicable, do you have dedicated customer support and product management? "},{"$f":"VLOOKUP(B14,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Company Overview","Yes",null,0,15,0,{"$f":"VLOOKUP($B14,'Standards Crosswalk'!$A:$H,3,FALSE)","v":{"$error":"#N/A"}},{"$f":"VLOOKUP($B14,'Standards Crosswalk'!$A:$H,4,FALSE)","v":{"$error":"#N/A"}},{"$f":"VLOOKUP($B14,'Standards Crosswalk'!$A:$H,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"VLOOKUP($B14,'Standards Crosswalk'!$A:$H,6,FALSE)","v":{"$error":"#N/A"}},{"$f":"VLOOKUP($B14,'Standards Crosswalk'!$A:$H,7,FALSE)","v":{"$error":"#N/A"}},{"$f":"VLOOKUP($B14,'Standards Crosswalk'!$A:$H,8,FALSE)","v":{"$error":"#N/A"}}]
[14,"COMP-08",{"$f":"VLOOKUP(B15,'K-12CVAT'!A:E,2,FALSE)","v":"If applicable, do you have dedicated software and systems development teams? "},null,false,1,"Company Overview","Yes",null,0,15,0]
[15,"HLAP-01",{"$f":"VLOOKUP(B16,'K-12CVAT'!A:E,2,FALSE)","v":"Does you system support various permission levels (for example, role based access control) for end users?"},{"$f":"VLOOKUP(B16,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Application/Service Security","Yes",{"$f":"VLOOKUP(B16,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},{"$f":"IF(ISNUMBER(FIND(H16,I16)), 1, 0)","v":0},25,0,{"$f":"VLOOKUP($B16,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 14"},{"$f":"VLOOKUP($B16,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B16,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"9.2.2"},{"$f":"VLOOKUP($B16,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.AC-4"},{"$f":"VLOOKUP($B16,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.1.1, 3.1.2, 3.1.7"},{"$f":"VLOOKUP($B16,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"AC-2, AC-3, AC-6"},"Disaster Recovery",{"$f":"COUNTIFS(B:B,\"HLDR*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLDR*\")","v":3},{"$f":"SUMIFS(L:L,B:B, \"HLDR*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLDR*\")","v":70},{"$f":"V16/W16","v":{"v":0,"d":"0.00%"}}]
[16,"HLAP-02",{"$f":"VLOOKUP(B17,'K-12CVAT'!A:E,2,FALSE)","v":"Do you enforce additional security controls for privileged access users (e.g. system administrators)? "},{"$f":"VLOOKUP(B17,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Application/Service Security","Yes",{"$f":"VLOOKUP(B17,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,25,0,{"$f":"VLOOKUP($B17,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 16"},{"$f":"VLOOKUP($B17,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B17,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"9.1.1"},{"$f":"VLOOKUP($B17,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.AC-4, PR.PT-3"},{"$f":"VLOOKUP($B17,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.4.9"},{"$f":"VLOOKUP($B17,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"CM-11"},"Firewalls, IDS, IPS, and Networking",{"$f":"COUNTIFS(B:B,\"HLFI*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLFI*\")","v":4},{"$f":"SUMIFS(L:L,B:B, \"HLFI*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLFI*\")","v":140},{"v":0,"d":"0.00%"}]
[17,"HLAP-03",{"$f":"VLOOKUP(B18,'K-12CVAT'!A:E,2,FALSE)","v":"Can employees access protected or sensitive data remotely?"},{"$f":"VLOOKUP(B18,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Application/Service Security","Yes",{"$f":"VLOOKUP(B18,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,20,0,{"$f":"VLOOKUP($B18,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 12"},{"$f":"VLOOKUP($B18,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B18,'Standards Crosswalk'!$A:$H,5,FALSE)","v":{"v":6.2,"d":"6"}},{"$f":"VLOOKUP($B18,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.PT-3"},{"$f":"VLOOKUP($B18,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.8, 3.1.20, 3.7.5, 3.8.2, 3.13.7"},{"$f":"VLOOKUP($B18,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"AC-3, CM-7; NIST SP 800-46"},"Physical Security",{"$f":"COUNTIFS(B:B,\"HLPH*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLPH*\")","v":2},{"$f":"SUMIFS(L:L,B:B, \"HLPH*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLPH*\")","v":80},{"v":0,"d":"0.00%"}]
[18,"HLAP-04",{"$f":"VLOOKUP(B19,'K-12CVAT'!A:E,2,FALSE)","v":"Is an audit log of access maintained by the system?"},{"$f":"VLOOKUP(B19,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Application/Service Security","Yes",{"$f":"VLOOKUP(B19,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,20,0,{"$f":"VLOOKUP($B19,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 2"},{"$f":"VLOOKUP($B19,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B19,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"12.1.1"},{"$f":"VLOOKUP($B19,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"ID.AM-1, ID.AM-2, ID.AM-4"},{"$f":"VLOOKUP($B19,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B19,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"CA-9, SC-4"},"Policies, Procedures, and Processes",{"$f":"COUNTIFS(B:B,\"HLPP*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLPP*\")","v":4},{"$f":"SUMIFS(L:L,B:B, \"HLPP*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLPP*\")","v":160},{"v":0,"d":"0.00%"}]
[19,"HLAP-05",{"$f":"VLOOKUP(B20,'K-12CVAT'!A:E,2,FALSE)","v":"If necessary would you be willing to share systems schematics, diagrams, data flow diagrams, etc. ? "},null,false,null,"Application/Service Security","Yes",null,0,10,0]
[20,"HLAP-06",{"$f":"VLOOKUP(B21,'K-12CVAT'!A:E,2,FALSE)","v":"Has your system been tested for input validation errors and do you have appropriate error messaging? "},null,false,1,"Application/Service Security","Yes",null,0,15,0]
[21,"HLAP-07",{"$f":"VLOOKUP(B22,'K-12CVAT'!A:E,2,FALSE)","v":"Is district data appropriately segmented and secured from other organization's data or access and can you demonstrate through reports? "},null,false,1,"Application/Service Security","Yes",null,0,15,0]
[22,"HLAP-08",{"$f":"VLOOKUP(B23,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have a quality multi tenancy environment with good reporting? "},{"$f":"VLOOKUP(B23,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Application/Service Security","Yes",{"$f":"VLOOKUP(B23,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,20,0,{"$f":"VLOOKUP($B23,'Standards Crosswalk'!$A:$H,3,FALSE)","v":{"$error":"#N/A"}},{"$f":"VLOOKUP($B23,'Standards Crosswalk'!$A:$H,4,FALSE)","v":{"$error":"#N/A"}},{"$f":"VLOOKUP($B23,'Standards Crosswalk'!$A:$H,5,FALSE)","v":{"$error":"#N/A"}},{"$f":"VLOOKUP($B23,'Standards Crosswalk'!$A:$H,6,FALSE)","v":{"$error":"#N/A"}},{"$f":"VLOOKUP($B23,'Standards Crosswalk'!$A:$H,7,FALSE)","v":{"$error":"#N/A"}},{"$f":"VLOOKUP($B23,'Standards Crosswalk'!$A:$H,8,FALSE)","v":{"$error":"#N/A"}},"Systems Management & Configuration",{"$f":"COUNTIFS(B:B,\"HLSY*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLSY*\")","v":3},{"$f":"SUMIFS(L:L,B:B, \"HLSY*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLSY*\")","v":45},{"v":0,"d":"0.00%"}]
[23,"HLAA-01",{"$f":"VLOOKUP(B24,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have strong authentication in place including MFA and additional controls for privileged access accounts?"},{"$f":"VLOOKUP(B24,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Authentication, Authorization, and Accounting","Yes",{"$f":"VLOOKUP(B24,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,15,0,{"$f":"VLOOKUP($B24,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 16"},{"$f":"VLOOKUP($B24,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B24,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"9.2.3, 9.3.1, 9.4.3"},{"$f":"VLOOKUP($B24,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.AC-1"},{"$f":"VLOOKUP($B24,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.5.7"},{"$f":"VLOOKUP($B24,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"IA-5(1)"},"Vulnerability Scanning",{"$f":"COUNTIFS(B:B,\"HLVU*\",J:J,\"=1\")","v":0},{"$f":"COUNTIF(B:B,\"HLVU*\")","v":2},{"$f":"SUMIFS(L:L,B:B, \"HLVU*\")","v":0},{"$f":"SUMIFS(K:K,B:B, \"HLVU*\")","v":80},{"v":0,"d":"0.00%"}]
[24,"HLAA-02",{"$f":"VLOOKUP(B25,'K-12CVAT'!A:E,2,FALSE)","v":"Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. SAMAL, OAuth, ClassLink, etc.)"},{"$f":"VLOOKUP(B25,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Authentication, Authorization, and Accounting","Yes",{"$f":"VLOOKUP(B25,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B25,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 16"},{"$f":"VLOOKUP($B25,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B25,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"9.1.1, 9.2.3, 9.3.1, 9.4.3"},{"$f":"VLOOKUP($B25,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.AC-1"},{"$f":"VLOOKUP($B25,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.5.1"},{"$f":"VLOOKUP($B25,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"IA-2, IA-5"},null,{"$f":"SUM(T2:T24)","v":0},61,0,{"$f":"IF(X25>=0.9,\"A\",IF(X25>=0.8,\"B\",IF(X25>=0.7,\"C\",IF(X25>=0.6,\"D\",\"F\"))))","v":"F"},{"$f":"AVERAGE(X2:X24)","v":{"v":0,"d":"0.00%"}}]
[25,"HLAA-03",{"$f":"VLOOKUP(B26,'K-12CVAT'!A:E,2,FALSE)","v":"Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication?"},{"$f":"VLOOKUP(B26,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Authentication, Authorization, and Accounting","Yes",{"$f":"VLOOKUP(B26,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,15,0,{"$f":"VLOOKUP($B26,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 16"},{"$f":"VLOOKUP($B26,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B26,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"9.4.3"},{"$f":"VLOOKUP($B26,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.AC-1, PR.AC-4"},{"$f":"VLOOKUP($B26,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B26,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0}]
[26,"HLAA-04",{"$f":"VLOOKUP(B27,'K-12CVAT'!A:E,2,FALSE)","v":"Do K-12 district staff have access to audit logs that allow them to see actions and activities taken by their users?"},{"$f":"VLOOKUP(B27,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Authentication, Authorization, and Accounting","Yes",{"$f":"VLOOKUP(B27,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,15,0,{"$f":"VLOOKUP($B27,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 16"},{"$f":"VLOOKUP($B27,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B27,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"9.4.3"},{"$f":"VLOOKUP($B27,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.AC-1, PR.AC-4"},{"$f":"VLOOKUP($B27,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B27,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0}]
[27,"HLBC-01",{"$f":"VLOOKUP(B28,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have a documented Business Continuity Plan (BCP)?"},{"$f":"VLOOKUP(B28,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Business Continuity Plan","Yes",{"$f":"VLOOKUP(B28,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,15,0,{"$f":"VLOOKUP($B28,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 10"},{"$f":"VLOOKUP($B28,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B28,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"17.1.1"},{"$f":"VLOOKUP($B28,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.IP-9"},{"$f":"VLOOKUP($B28,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.12.2"},{"$f":"VLOOKUP($B28,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34"}]
[28,"HLBC-02",{"$f":"VLOOKUP(B29,'K-12CVAT'!A:E,2,FALSE)","v":"Is there a documented communication plan in your BCP for impacted clients?"},{"$f":"VLOOKUP(B29,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Business Continuity Plan","Yes",{"$f":"VLOOKUP(B29,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,10,0,{"$f":"VLOOKUP($B29,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 10"},{"$f":"VLOOKUP($B29,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B29,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"17.1.2"},{"$f":"VLOOKUP($B29,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.IP-9"},{"$f":"VLOOKUP($B29,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.12.2"},{"$f":"VLOOKUP($B29,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34"}]
[29,"HLBC-03",{"$f":"VLOOKUP(B30,'K-12CVAT'!A:E,2,FALSE)","v":"Are all components of the BCP reviewed at least annually and updated as needed to reflect change? "},{"$f":"VLOOKUP(B30,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Business Continuity Plan","Yes",{"$f":"VLOOKUP(B30,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,15,0,{"$f":"VLOOKUP($B30,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 10"},{"$f":"VLOOKUP($B30,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B30,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"17.1.2"},{"$f":"VLOOKUP($B30,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.IP-9"},{"$f":"VLOOKUP($B30,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.12.2"},{"$f":"VLOOKUP($B30,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34"}]
[30,"HLBC-04",{"$f":"VLOOKUP(B31,'K-12CVAT'!A:E,2,FALSE)","v":"Does your organization regularly test the failover or recovery of production environment for the purposes of BCP and continuity? "},{"$f":"VLOOKUP(B31,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Business Continuity Plan","Yes",{"$f":"VLOOKUP(B31,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,15,0,{"$f":"VLOOKUP($B31,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 10"},{"$f":"VLOOKUP($B31,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B31,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"17.1.3"},{"$f":"VLOOKUP($B31,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.IP-9"},{"$f":"VLOOKUP($B31,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B31,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"AC-5, CP-4, CP-10; NIST SP 800-34"}]
[31,"HLCH-01",{"$f":"VLOOKUP(B32,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have a documented and currently followed change management process (CMP) for standard and emergency changes? "},{"$f":"VLOOKUP(B32,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Change Management","Yes",{"$f":"VLOOKUP(B32,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,25,0,{"$f":"VLOOKUP($B32,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 10"},{"$f":"VLOOKUP($B32,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B32,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"12.1.2"},{"$f":"VLOOKUP($B32,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.IP-3"},{"$f":"VLOOKUP($B32,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.4.3, 3.4.4"},{"$f":"VLOOKUP($B32,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"CM-3, CM-4, CM-5"}]
[32,"HLCH-02",{"$f":"VLOOKUP(B33,'K-12CVAT'!A:E,2,FALSE)","v":"Will the district be notified of  changes to your environment that could impact the district's security posture or service availability?"},{"$f":"VLOOKUP(B33,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Change Management","Yes",{"$f":"VLOOKUP(B33,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,20,0,{"$f":"VLOOKUP($B33,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 10"},{"$f":"VLOOKUP($B33,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B33,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"12.1.2"},{"$f":"VLOOKUP($B33,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B33,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B33,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"CM-3, CM-4, CM-5"}]
[33,"HLCH-03",{"$f":"VLOOKUP(B34,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have policy and procedure, currently implemented, guiding how known vulnerabilities and zero day attack risks are mitigated until patches are available and applied?"},{"$f":"VLOOKUP(B34,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Change Management","Yes",{"$f":"VLOOKUP(B34,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,20,0,{"$f":"VLOOKUP($B34,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 13"},{"$f":"VLOOKUP($B34,'Standards Crosswalk'!$A:$H,4,FALSE)","v":"§164.308(a)(1)(ii)(B)"},{"$f":"VLOOKUP($B34,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"12.6.1"},{"$f":"VLOOKUP($B34,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B34,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B34,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"CM-3, CM-4, CM-5"}]
[34,"HLDA-01",{"$f":"VLOOKUP(B35,'K-12CVAT'!A:E,2,FALSE)","v":"Do you  logically separate institution's data from that of other customers?"},{"$f":"VLOOKUP(B35,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Data","Yes",{"$f":"VLOOKUP(B35,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,25,0,{"$f":"VLOOKUP($B35,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 12"},{"$f":"VLOOKUP($B35,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B35,'Standards Crosswalk'!$A:$H,5,FALSE)","v":0},{"$f":"VLOOKUP($B35,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.AC-2, PR.IP-5"},{"$f":"VLOOKUP($B35,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.1.3, 3.8.1"},{"$f":"VLOOKUP($B35,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"AC-4, MP-2, MP-4"}]
[35,"HLDA-02",{"$f":"VLOOKUP(B36,'K-12CVAT'!A:E,2,FALSE)","v":"Is sensitive data encrypted in transport? (e.g. system-to-client)"},{"$f":"VLOOKUP(B36,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Data","Yes",{"$f":"VLOOKUP(B36,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B36,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 13"},{"$f":"VLOOKUP($B36,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B36,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"8.2.3, 10.1.1"},{"$f":"VLOOKUP($B36,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.DS-1, PR.DS-2"},{"$f":"VLOOKUP($B36,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.1.19, 3.8.1"},{"$f":"VLOOKUP($B36,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"MP-2, AC-19(5)"}]
[36,"HLDA-03",{"$f":"VLOOKUP(B37,'K-12CVAT'!A:E,2,FALSE)","v":"Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)?"},{"$f":"VLOOKUP(B37,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Data","Yes",{"$f":"VLOOKUP(B37,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B37,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 13"},{"$f":"VLOOKUP($B37,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B37,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"8.2.3, 10.1.1"},{"$f":"VLOOKUP($B37,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.DS-1"},{"$f":"VLOOKUP($B37,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.1.19, 3.8.1"},{"$f":"VLOOKUP($B37,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"MP-2, AC-19(5)"}]
[37,"HLDA-04",{"$f":"VLOOKUP(B38,'K-12CVAT'!A:E,2,FALSE)","v":"Do backups containing institution data ever leave the United States, either physically or via network routing?"},{"$f":"VLOOKUP(B38,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Data","No",{"$f":"VLOOKUP(B38,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B38,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 13"},{"$f":"VLOOKUP($B38,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B38,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"12.3.1"},{"$f":"VLOOKUP($B38,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B38,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.8.9"},{"$f":"VLOOKUP($B38,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"CP-9, MP-5"}]
[38,"HLDA-05",{"$f":"VLOOKUP(B39,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures?"},{"$f":"VLOOKUP(B39,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Data","Yes",{"$f":"VLOOKUP(B39,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B39,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 13"},{"$f":"VLOOKUP($B39,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B39,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"8.3.1"},{"$f":"VLOOKUP($B39,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.DS-3"},{"$f":"VLOOKUP($B39,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.7.1, 3.7.2, 3.8.3"},{"$f":"VLOOKUP($B39,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"CP-9 MP-6, NIST SP 800-60, NIST SP 800-88, AC-2, AC-6, IA-4, PM-2, PM-10, SI-5, MA-2, MA-3, MP-6"}]
[39,"HLDA-06",{"$f":"VLOOKUP(B40,'K-12CVAT'!A:E,2,FALSE)","v":"Is any institution data visible in system administration modules/tools?"},{"$f":"VLOOKUP(B40,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Data","No",{"$f":"VLOOKUP(B40,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B40,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 13, CSC 14"},{"$f":"VLOOKUP($B40,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B40,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"14.2.5"},{"$f":"VLOOKUP($B40,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.AC-4"},{"$f":"VLOOKUP($B40,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B40,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0}]
[40,"HLDB-01",{"$f":"VLOOKUP(B41,'K-12CVAT'!A:E,2,FALSE)","v":"Does the database implement encryption of specified data elements in storage consistent with current encryption standards?"},{"$f":"VLOOKUP(B41,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Database","Yes",{"$f":"VLOOKUP(B41,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,60,0,{"$f":"VLOOKUP($B41,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 13"},{"$f":"VLOOKUP($B41,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B41,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"10.1.1"},{"$f":"VLOOKUP($B41,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.DS-1"},{"$f":"VLOOKUP($B41,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B41,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0}]
[41,"HLDC-01",{"$f":"VLOOKUP(B42,'K-12CVAT'!A:E,2,FALSE)","v":"Will any institution data leave the United States?"},{"$f":"VLOOKUP(B42,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Datacenter","No",{"$f":"VLOOKUP(B42,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B42,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 12"},{"$f":"VLOOKUP($B42,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B42,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"11.2.1"},{"$f":"VLOOKUP($B42,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B42,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B42,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0}]
[42,"HLDC-02",{"$f":"VLOOKUP(B43,'K-12CVAT'!A:E,2,FALSE)","v":"Does your company own the physical data center where the institution's data will reside?"},{"$f":"VLOOKUP(B43,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Datacenter","Yes",{"$f":"VLOOKUP(B43,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B43,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 14"},{"$f":"VLOOKUP($B43,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B43,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"11.1.1"},{"$f":"VLOOKUP($B43,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.AC-2, PR.IP-5"},{"$f":"VLOOKUP($B43,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B43,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0}]
[43,"HLDC-03",{"$f":"VLOOKUP(B44,'K-12CVAT'!A:E,2,FALSE)","v":"Does the hosting provider have a SOC 2 Type 2 report available?"},{"$f":"VLOOKUP(B44,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Datacenter","Yes",{"$f":"VLOOKUP(B44,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B44,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 13"},{"$f":"VLOOKUP($B44,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B44,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"11.1.1"},{"$f":"VLOOKUP($B44,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B44,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B44,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0}]
[44,"HLDR-01",{"$f":"VLOOKUP(B45,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have a Disaster Recovery Plan (DRP)?"},{"$f":"VLOOKUP(B45,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Disaster Recovery Plan","Yes",{"$f":"VLOOKUP(B45,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,15,0,{"$f":"VLOOKUP($B45,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 10"},{"$f":"VLOOKUP($B45,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B45,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"17.1.1"},{"$f":"VLOOKUP($B45,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.IP-9"},{"$f":"VLOOKUP($B45,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.12.2"},{"$f":"VLOOKUP($B45,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"AC-5, CP-4, CP-10, NIST SP 800-34"}]
[45,"HLDR-02",{"$f":"VLOOKUP(B46,'K-12CVAT'!A:E,2,FALSE)","v":"Are any disaster recovery locations outside the institution's of the United States?"},{"$f":"VLOOKUP(B46,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Disaster Recovery Plan","No",{"$f":"VLOOKUP(B46,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B46,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 10, CSC 12"},{"$f":"VLOOKUP($B46,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B46,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"17.1.1"},{"$f":"VLOOKUP($B46,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.IP-9"},{"$f":"VLOOKUP($B46,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B46,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"AC-5, CP-4, CP-10, NIST SP 800-34"}]
[46,"HLDR-03",{"$f":"VLOOKUP(B47,'K-12CVAT'!A:E,2,FALSE)","v":"Are all components of the DRP reviewed at least annually and updated as needed to reflect change? "},{"$f":"VLOOKUP(B47,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Disaster Recovery Plan","Yes",{"$f":"VLOOKUP(B47,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,15,0,{"$f":"VLOOKUP($B47,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 10"},{"$f":"VLOOKUP($B47,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B47,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"17.1.1"},{"$f":"VLOOKUP($B47,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.IP-9"},{"$f":"VLOOKUP($B47,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.12.2"},{"$f":"VLOOKUP($B47,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"AC-5, CP-4, CP-10, NIST SP 800-34"}]
[47,"HLFI-01",{"$f":"VLOOKUP(B48,'K-12CVAT'!A:E,2,FALSE)","v":"Are you utilizing a web application firewall (WAF) and/or a stateful packet inspection (SPI) firewall?"},{"$f":"VLOOKUP(B48,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Firewalls, IDS, IPS, and Networking","Yes",{"$f":"VLOOKUP(B48,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,20,0,{"$f":"VLOOKUP($B48,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 9"},{"$f":"VLOOKUP($B48,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B48,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"13.1.1"},{"$f":"VLOOKUP($B48,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.DS-5"},null,{"$f":"VLOOKUP($B48,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0}]
[48,"HLFI-02",{"$f":"VLOOKUP(B49,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have a documented policy for firewall change requests?"},{"$f":"VLOOKUP(B49,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Firewalls, IDS, IPS, and Networking","Yes",{"$f":"VLOOKUP(B49,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B49,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 9"},{"$f":"VLOOKUP($B49,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B49,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"12.1.2"},{"$f":"VLOOKUP($B49,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.AC-5"},{"$f":"VLOOKUP($B49,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B49,'Standards Crosswalk'!$A:$H,8,FALSE)","v":0}]
[49,"HLFI-03",{"$f":"VLOOKUP(B50,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have automated  threat monitoring and notification systems enabled? (for example, SEIM, EDPM, etc.)"},{"$f":"VLOOKUP(B50,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Firewalls, IDS, IPS, and Networking","Yes",{"$f":"VLOOKUP(B50,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B50,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 19"},{"$f":"VLOOKUP($B50,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B50,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"12.4.1"},{"$f":"VLOOKUP($B50,'Standards Crosswalk'!$A:$H,6,FALSE)","v":0},{"$f":"VLOOKUP($B50,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.6.1, 3.14.6, 3.14.7"},{"$f":"VLOOKUP($B50,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"IR-2, IR-4, IR-9"}]
[50,"HLFI-04",{"$f":"VLOOKUP(B51,'K-12CVAT'!A:E,2,FALSE)","v":"Is there a 24x7x365 monitoring and response process in place for intrusions?"},{"$f":"VLOOKUP(B51,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Firewalls, IDS, IPS, and Networking","Yes",{"$f":"VLOOKUP(B51,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B51,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 19"},{"$f":"VLOOKUP($B51,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B51,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"12.4.1"},{"$f":"VLOOKUP($B51,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"DE.CM-1, DE.CM-2, DE.CM-7"},{"$f":"VLOOKUP($B51,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.6.1, 3.14.6, 3.14.7"},{"$f":"VLOOKUP($B51,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"IR-2, IR-4, IR-10"}]
[51,"HLPH-01",{"$f":"VLOOKUP(B52,'K-12CVAT'!A:E,2,FALSE)","v":"Does your organization have physical security controls and policies in place?"},{"$f":"VLOOKUP(B52,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Physical Security","Yes",{"$f":"VLOOKUP(B52,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B52,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 3"},{"$f":"VLOOKUP($B52,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B52,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"11.1.1"},{"$f":"VLOOKUP($B52,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.AC-2, PR.AT-5, PR.IP-5, DE.CM-2"},{"$f":"VLOOKUP($B52,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.8.2, 3.10.1, 3.10.2, 3.10.5, 3.10.6, 3.12.1"},{"$f":"VLOOKUP($B52,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"MP-4, PE-2, PE-5, PE-6, PE-17"}]
[52,"HLPH-02",{"$f":"VLOOKUP(B53,'K-12CVAT'!A:E,2,FALSE)","v":"Are employees allowed to access or transport customer data, copy or store customer data on personally owned devices, or physically remove data from the protected infrastructure of your organization? "},{"$f":"VLOOKUP(B53,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Physical Security","No",{"$f":"VLOOKUP(B53,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B53,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 13"},{"$f":"VLOOKUP($B53,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B53,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"8.2.3"},{"$f":"VLOOKUP($B53,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.AC-2, PR.AC-4, PR.DS-1, PR.DS-3, PR.DS-5"},{"$f":"VLOOKUP($B53,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.8.1, 3.8.5, 3.8.7"},{"$f":"VLOOKUP($B53,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"MP-2, MP-5, MP-7"}]
[53,"HLPP-01",{"$f":"VLOOKUP(B54,'K-12CVAT'!A:E,2,FALSE)","v":"Can you share the organization chart, mission statement, and policies for your information security unit?"},{"$f":"VLOOKUP(B54,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Policies, Procedures and Processes","Yes",{"$f":"VLOOKUP(B54,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B54,'Standards Crosswalk'!$A:$H,3,FALSE)","v":0},{"$f":"VLOOKUP($B54,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B54,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"5.1.1"},{"$f":"VLOOKUP($B54,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"ID.GV-2"},{"$f":"VLOOKUP($B54,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.9.1, 3.9.2"},{"$f":"VLOOKUP($B54,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"PM-2, PM-10, SI-5, CA-5, PM-1"}]
[54,"HLPP-02",{"$f":"VLOOKUP(B55,'K-12CVAT'!A:E,2,FALSE)","v":"Are information security principles designed into the product lifecycle (e.g. are you incorporating and upgrading security as an essential design element)?"},{"$f":"VLOOKUP(B55,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Policies, Procedures and Processes","Yes",{"$f":"VLOOKUP(B55,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B55,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 4"},{"$f":"VLOOKUP($B55,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B55,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"14.2.1"},{"$f":"VLOOKUP($B55,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.IP-2"},{"$f":"VLOOKUP($B55,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.13.2"},{"$f":"VLOOKUP($B55,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"CA-5, CM-3, PM-1, SA-15, SA-3, SA-8, SC-2"}]
[55,"HLPP-03",{"$f":"VLOOKUP(B56,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have a formal, documented incident response plan that covers physical and cyber incident response and defined severity levels?"},{"$f":"VLOOKUP(B56,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Policies, Procedures and Processes","Yes",{"$f":"VLOOKUP(B56,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B56,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 19"},{"$f":"VLOOKUP($B56,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B56,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"16.1.5"},{"$f":"VLOOKUP($B56,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.IP-9"},{"$f":"VLOOKUP($B56,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.6.1, 3.12.2"},{"$f":"VLOOKUP($B56,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"CA-5, PM-1, IR-4, IR-5, IR-7, IR-8"}]
[56,"HLPP-04",{"$f":"VLOOKUP(B57,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have a documented information security policy?"},{"$f":"VLOOKUP(B57,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Policies, Procedures and Processes","Yes",{"$f":"VLOOKUP(B57,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B57,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 17"},{"$f":"VLOOKUP($B57,'Standards Crosswalk'!$A:$H,4,FALSE)","v":"§164.308(a)(1)(i)"},{"$f":"VLOOKUP($B57,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"5.1.1"},{"$f":"VLOOKUP($B57,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"ID.GV-3"},{"$f":"VLOOKUP($B57,'Standards Crosswalk'!$A:$H,7,FALSE)","v":0},{"$f":"VLOOKUP($B57,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"CA-5, PM-1"}]
[57,"HLSY-01",{"$f":"VLOOKUP(B58,'K-12CVAT'!A:E,2,FALSE)","v":"Do you employ network and administrative segmentation in the management of this service? (for example, systems supporting the service managed via a separate management network, separate administrative controls and access, etc.)"},{"$f":"VLOOKUP(B58,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Systems Management & Configuration","Yes",{"$f":"VLOOKUP(B58,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,15,0,{"$f":"VLOOKUP($B58,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 12"},{"$f":"VLOOKUP($B58,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B58,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"13.1.1"},{"$f":"VLOOKUP($B58,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.PT-4"},{"$f":"VLOOKUP($B58,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.1.3"},{"$f":"VLOOKUP($B58,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"AC-4"}]
[58,"HLSY-02",{"$f":"VLOOKUP(B59,'K-12CVAT'!A:E,2,FALSE)","v":"Do you have standard hardened configurations for severs, appliances and mobile devices?"},null,false,1,"Systems Management & Configuration","Yes",null,0,15,0,{"$f":"VLOOKUP($B59,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 3"}]
[59,"HLSY-03",{"$f":"VLOOKUP(B60,'K-12CVAT'!A:E,2,FALSE)","v":"Do you encrypt company owned mobile devices?"},{"$f":"VLOOKUP(B60,'K-12CVAT'!A:E,4,FALSE)","v":0},false,1,"Systems Management & Configuration","Yes",{"$f":"VLOOKUP(B60,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,15,0,{"$f":"VLOOKUP($B60,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 13"},{"$f":"VLOOKUP($B60,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B60,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"12.1.1"},{"$f":"VLOOKUP($B60,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"PR.IP-1, PR.IP-2"},{"$f":"VLOOKUP($B60,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.1.18, 3.7.1, 3.13.13"},{"$f":"VLOOKUP($B60,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"CM-2, CM-6, CM-3, AC-19, MA-2"}]
[60,"HLVU-01",{"$f":"VLOOKUP(B61,'K-12CVAT'!A:E,2,FALSE)","v":"Have your systems and applications had a third party security assessment completed in the last year?"},{"$f":"VLOOKUP(B61,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Vulnerability Scanning","Yes",{"$f":"VLOOKUP(B61,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B61,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 4"},{"$f":"VLOOKUP($B61,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B61,'Standards Crosswalk'!$A:$H,5,FALSE)","v":"12.6.1"},{"$f":"VLOOKUP($B61,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"DE.CM-8"},{"$f":"VLOOKUP($B61,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.11.1, 3.11.2, 3.11.3"},{"$f":"VLOOKUP($B61,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"SI-2"}]
[61,"HLVU-02",{"$f":"VLOOKUP(B62,'K-12CVAT'!A:E,2,FALSE)","v":"Are your applications scanned for vulnerabilities [that are remediated]?                            "},{"$f":"VLOOKUP(B62,'K-12CVAT'!A:E,4,FALSE)","v":0},true,1,"Vulnerability Scanning","Yes",{"$f":"VLOOKUP(B62,'K-12CVAT'!$A$6:$C$318,3,FALSE)","v":0},0,40,0,{"$f":"VLOOKUP($B62,'Standards Crosswalk'!$A:$H,3,FALSE)","v":"CSC 4"},{"$f":"VLOOKUP($B62,'Standards Crosswalk'!$A:$H,4,FALSE)","v":0},{"$f":"VLOOKUP($B62,'Standards Crosswalk'!$A:$H,5,FALSE)","v":0},{"$f":"VLOOKUP($B62,'Standards Crosswalk'!$A:$H,6,FALSE)","v":"DE.CM-8"},{"$f":"VLOOKUP($B62,'Standards Crosswalk'!$A:$H,7,FALSE)","v":"3.11.1, 3.11.2, 3.11.3"},{"$f":"VLOOKUP($B62,'Standards Crosswalk'!$A:$H,8,FALSE)","v":"SI-2"}]

{"sheet":"Values","index":11,"n_rows":64,"n_cols":2,"rows_kept":64,"hidden":true}
["Campus"]
[]
["Answers"]
["Yes"]
["No"]
["N/A"]
[]
["DRPTestingSchedule"]
["Quarterly"]
["Semi-annually"]
["Annually"]
["Other"]
[]
["NetworkTypes"]
["Exclusive VLAN"]
["Shared VLAN"]
["Physically Separate"]
["Flat Shared Network"]
["Other"]
[]
["Consulting"]
["On-premises"]
["Remotely"]
[]
["DR Types"]
["Cold"]
["Hot"]
[]
["Tenants"]
["Single-tenant"]
["Multiple-tenant"]
[]
["SharedAssessmentsConfirmation"]
["Yes; OK to Share"]
["No; Sharing Disallowed"]
[]
["SharedAssessmentListingConfirmation"]
["Yes; OK to List"]
["No; Listing Disallowed"]
[]
["UptimeTiers"]
["Tier I"]
["Tier II"]
["Tier III"]
["Tier IV"]
["N/A"]
[]
["Segmentation"]
["Logically"]
["Physically"]
["Logically+Physically"]
[]
["FirewallOptions"]
["Stateful Packet Inspection (SPI)"]
["Web Application Firewall (WAF)"]
["SPI+WAF"]
[]
["Frameworks"]
["CIS Critical Security Controls v6.1",4]
["HIPAA",5]
["ISO 27002:2013",6]
["NIST Cybersecurity Framework",7]
["NIST SP 800-171r1",8]
["NIST SP 800-53r4",9]

{"sheet":"ChangeLog","index":12,"n_rows":5,"n_cols":3,"rows_kept":5,"merged":[[0,0,0,2],[1,0,1,2]]}
["K-12  Community Vendor Assessment Toolkit - Lite - Change Log"]
[]
["Version","Date","Description of Change"]
["v0.1","2022-03-01","Adapted original HECVAT-Lite to K-12 model, updated language and made attribution to original work provided by Educause"]
["v3.0","2022-11-30","K-12CVAT 3.0 version released to the public by CoSN"]