Cloud Security Questionnaire

Organization and Scope

1. Which HARVARD BUSINESS IMPACT Enterprise products and services are covered by this questionnaire? Harvard ManageMentor, HBR Spark, HBP Collection, Harvard Business Impact Enterprise Cohort Programs

Security Governance and Risk

1. Does HARVARD BUSINESS IMPACT maintain a documented information security program? Yes
2. Is there an executive or designated role accountable for information security? Yes
3. Are information security policies formally approved and reviewed on a regular basis? Yes
4. Does HARVARD BUSINESS IMPACT conduct formal information security risk assessments? Yes
5. Are third-party and vendor security risks assessed as part of the risk management process? Yes

Cloud Hosting and Architecture

1. Which cloud service providers host HARVARD BUSINESS IMPACT Enterprise services? Solutions developed by HBI leverage AWS to host our web applications. We partner with D2L to leverage their Brightspace platform to deliver our Cohorts. D2L’s Brightspace is also hosted in AWS
2. Are customer environments logically segregated in the cloud? Yes
3. Are production and non-production environments separated? Yes
4. Is access to cloud infrastructure restricted to authorized personnel only? Yes

Data Protection and Privacy

1. Does HARVARD BUSINESS IMPACT maintain a formal data classification standard? Yes
2. What categories of customer data are processed by HARVARD BUSINESS IMPACT Enterprise services? Personally Identifiable Information and Personal Information are recommended however customer has the authority over what and how much data is provided as the data controller. 
3. Is customer data encrypted at rest? Yes
4. Is customer data encrypted in transit? Yes
5. Are encryption standards and key management practices defined and documented? Yes

Data Residency and Location

1. In which geographic regions is customer data stored and processed? AWS-US-East-1 region leveraging AWS RDS backup in AWS – US- East 2
2. Does HARVARD BUSINESS IMPACT support EU-based or region-specific data hosting options? In the near future, we will offer HBR Spark customers the option to store PII in our EU datacenter however PI and web application infrastructure will remain in our US datacenter. Additionally, customer user profile data may be written to logs to support operations by information security and application development for troubleshooting, maintenance and cybersecurity. These logs must be stored within the HBP logging environment in the US and may not be copied outside of that environment.
3. Are access and support controls aligned with applicable data residency requirements? No

Identity and Access Management

1. Are role-based access controls enforced for systems handling customer data? Yes
2. Is multi-factor authentication required for administrative access? Yes
3. Are user access rights reviewed periodically? Yes

Monitoring, Logging, and Vulnerability Management

1. Are security-relevant events logged in cloud environments? Yes
2. Does HARVARD BUSINESS IMPACT monitor systems for suspicious or anomalous activity? Yes
3. Is there a formal vulnerability management program in place? Yes

Secure Development

1. Does HARVARD BUSINESS IMPACT follow secure software development lifecycle (SDLC) practices? Yes
2. Are security reviews or testing performed before releasing changes to production? Yes

Incident Response and Resilience

1. Does HARVARD BUSINESS IMPACT maintain a documented incident response plan? Yes
2. Are customers notified of security incidents in accordance with contractual or regulatory requirements? Yes
3. Are backups performed for systems containing customer data? Yes
4. Are business continuity (BCP) and disaster recovery plans (DRP) maintained? Yes

Third Parties and Compliance

1. Are vendors and subprocessors subject to security due diligence? Yes
2. Are independent security audits or assessments conducted? Yes

Data Retention and Customer Responsibilities

1. Does HARVARD BUSINESS IMPACT maintain documented data retention and deletion policies? Yes
2. Are customers responsible for managing user access within the HARVARD BUSINESS IMPACT platform? No