Which are Out OF Scope Services for Cloud Hosting Services?

Which other factors I need to consider before signing the Cloud Hosting Service Agreement?

Does the provider perform regular penetration testing, vulnerability management, and intrusion prevention?

(‘Incl’) – Done when initial setup is done.

Are all network devices located in secure facilities and under controlled circumstances (e.g. ID cards, entry logs)?

(‘Incl’) – Done when initial setup is done. For more details, (aws.amazon.com/security/)

How are these backups secured? Disposed of?

(‘Incl’) – Security & Disposing are part of administration.

Are software vulnerabilities patched routinely or automatically on all servers?

(‘Incl’) – All infrastructure level patches will be done on monthly cycle for minor patches. For major patches it would be informed to customer before patching it.

Does the provider provide the organization the ability to audit the security and privacy of records?

Yes – Can be worked out depending on the details to be audited

Have the provider’s security operations been reviewed or audited by an outside group?

Yes – Can be done

Does the provider comply with a security standard such as the International Organization for Standardization (ISO), the Payment Card Industry Data Security Standards (PCI DSS)?

Not available (Unavailable) – However it is available from the hosting provider

Will ‘live’ client data be used in non-production (e.g. test or development, training) environment?

Depending on client agreement and setup, it varies. We strongly suggest to have production environment different from staging, QA and dev instance.

Are these environments secure to the same standard as production data?

Yes. Might have to temporary allow access to debug in case of issues.

What happens if your online service provider has a data breach?

It can be rectified; however, we would suggest to have third party security testing done so both parties are on same page based on report.

Do you have the ability to perform security incident investigations or e-discovery? If not, will the provider assist you? For example, does the provider log end user, administrative and maintenance activity and are these logs available to the organization for incident investigation?

Yes. We can provide assistance for security incidents if happened including application logs if for administrative and maintenance activities, if application supports.

How does the provider assure the proper management and disposal of data?
a) The provider should only keep data as long as necessary to perform the services to the organization.

Yes. Upon termination of services data would be deleted depending on requirement of backup to be transferred.

How will the provider delete data?
a) Is data deleted on a specific schedule or only on termination of contract? Can your organization request that information be deleted? What is the protocol for such a request?

Generally, it happens to be on termination of contract. Until without prior written approval from business owner hosting team never deletes data.

You should be able to request a copy of the information maintained by the provider at any time.

Until without prior written approval from business owner hosting team can provide copy of data anytime.

All data disclosed to the provider or collected by the provider must be disposed of by reasonable means to protect against unauthorized access or use.

Yes. Policy can be setup for the process to dispose

Upon termination of the contract, the provider should return all records or data and properly delete any copies still in its possession

Yes.

Where will the information be stored and how is data “at rest” protected (i.e. data in the data center)?
a) Will any data be stored outside Canada?
b) Is all or some data at rest encrypted (e.g. just passwords, passwords and sensitive data, all data) and what encryption method is used?

a) Options include:
b) (‘Incl’) – All data will be encrypted by changing one configuration of application.

How will the information be stored? If the cloud application is multi-tenant (several districts on one server/instance) hosting, how is data and access separated from other customers?

We wouldn’t suggest multi-tenant solution as it has security flaws.

Are the physical server(s) in a secured, locked and monitored environment to prevent unauthorized entry and/or theft?

This is the responsibility of the organization, not the provider, but it is possible to do within the features of the shared hosting price (Possible)

How does the provider protect data in transit? e.g. SSL, hashing?

a) (‘Incl’) – It will be taken care for Hosting & Support team.
b) DHIS2 platform allows various integration like Google Maps. Limited data is being exposed to such parties when using/leveraging features implemented in such platforms.
c) Support team will have super user credentials. So, based on request, L1 support staff will be able to use ‘super admin’ credentials to manage users account.

Who has access to information stored or processed by the provider?
a) Does the provider perform background checks on personnel with administrative access to servers, applications and customer data?
b) Does the provider subcontract any functions, such as analytics? (this includes Google Analytics)
c) What is the provider’s process for authenticating callers and resetting access controls, as well as establishing and deleting accounts?

This is the responsibility of the organization, not the provider, but it is possible to do within the features of the shared hosting price (Possible)

If client or other sensitive data is transferred/uploaded to the provider, are all uploads via SFTP or HTPPS?
How does the provider assure the proper management and disposal of data?
a) The provider should only keep data as long as necessary to perform the services to the organization.

Yes. Upon termination of services data would be deleted depending on requirement of backup to be transferred.

How will the provider delete data?
a) Is data deleted on a specific schedule or only on termination of contract? Can your organization request that information be deleted? What is the protocol for such a request?

Generally, it happens to be on termination of contract. Until without prior written approval from business owner hosting team never deletes data.

You should be able to request a copy of the information maintained by the provider at any time.

Until without prior written approval from business owner hosting team can provide copy of data anytime.

All data disclosed to the provider or collected by the provider must be disposed of by reasonable means to protect against unauthorized access or use.

Yes. Policy can be setup for the process to dispose

Upon termination of the contract, the provider should return all records or data and properly delete any copies still in its possession

Yes

Does the provider follow standardized and documented procedures for coding, configuration management, patch installation, and change management for all servers involved in delivery of contracted services?

Yes, for configuration management, patch installation & change management of server. We will follow DHIS2 coding standard.

Are practices regularly audited?

Yes, on quarterly basis.

Does the provider notify the organization about any changes that will affect the security, storage, usage, or disposal of any information received or collected directly from the organization?

Yes it would be informed where security, storage, usage or disposal policy & process are updated or affected.

Does the provider offer a guaranteed service level?

Yes. 99.9%. It would also depend on hosting provider which we may might not be guarantee.

What is the backup-and-restore process in case of a disaster?

Yes – There wold be hot-cold disaster where from backup systems can be restore, with chances of losing data up to certain hours.

What is the provider’s protection against denial-of-service attack?

Yes – We would have two different modules in web server to take care of this.