Verkada 40 Cybersecurity Questions User Manual

: June 17, 2024
: Verkada

Table of Contents

40 Cybersecurity Questions
Documents / Resources
- Read User Manual Online (PDF format)
- Download This Manual (PDF format)

User Manual

40 Cybersecurity Questions

Verkada 40 Cybersecurity Questions

40 Cybersecurity Questions to Ask Your Security Vendor (And Your Team) Before Buying
Whether you’re looking at pure cloud, hybrid cloud, or traditional physical security systems, make sure your setup remains strong long-term with these 40 cybersecurity questions.

Category	Question	Yes	No	Notes
Network Security & Encryption	Are the vendor’s systems configured to use the
Zero Trust model?

Is the data encrypted both in transit and at rest? If so, which ciphers does the vendor use?| | |
Do devices on the system make outbound connections only? If not, what types of inbound connections are necessary to use the platform?| | |
Updates & Patch Management| Are backend services continuously and automatically updated with the latest security patches?| | |
Does the vendor provide patches and upgrades on a regular cadence? If so, what is the frequency?| | |
Compliance & Testing| Is the vendor SOC 2 Type I and Type II compliant?| | |
Is the vendor FY2019 NDAA complaint?| | |
Does the vendor perform quarterly penetration testing? If not, how frequently do they perform penetration tests?| | |
Does the vendor offer a Bug Bounty program?| | |
Industry-Specific Regulatory
Compliance (if relevant)| Is the vendor FedRAMP authorized?| | |
Does the vendor keep you HIPAA compliant?| | |
Can the vendor consider or sign BAA agreements?| | |
Can the vendor help you meet PCI requirements?| | |
Authentication & Access| Does the vendor support multi-factor authentication?| | |
Does the vendor offer self-serve SSO/SAML/SCIM protocols?| | |
What is the physical location in which the data is stored? (Where are the servers located?)| | |
Does the vendor use industry-leading cloud service providers like AWS or Microsoft Azure? If not, which cloud service provider does the vendor use?| | |
Do the vendor’s data center locations comply with GDPR?| | |
Does the vendor allow you to set users’ session durations?| | |
Does the vendor allow you to create and assign user groups, each with specific permissions?| | |
Does the vendor’s system have a default or base username and password that cannot be changed?| | |
Data Management & Privacy| Does the vendor’s system have a default or base username and password that cannot be changed?| | |
Does the vendor refrain from monetizing customers’ private data?| | |
Does the vendor have easily accessible policies on data retention and deletion? What are they?| | |
Does the vendor’s solution require any collection of personal data (PII)?| | |
Vendor Management &
Supply Chain Security| Does the vendor offer configuration management tools?| | |
Does the vendor offer enhanced audit logging?| | |
Will the vendor detail its external, third-party dependencies? If so, what are they?| | |
Service Features & Infrastructure| Does the solution allow you to enable, disable, or permanently remove select features for compliance, security, or privacy purposes?| | |
If the solution is multi-tenant, can the vendor detail how customer data is segregated?| | |
Does the vendor offer 24×7 support?| | |
Does the vendor have a disaster recovery procedure?| | |
Does the vendor have a change control process?| | |
Do the devices require a direct ethernet connection?| | |
Will the vendor tell you how many customers have deployed their solution? If so, how many?| | |
Does the vendor have bandwidth requirements?
If so, what are they?| | |
Your Company’s Internal Processes| Does your company give privacy and data protection training to your employees on a regular basis?| | |
Do your employees have the ability to access internal data? If so, what controls are in place?| | |
Do you have tightened controls around your supply-chain and manufacturing parts? What are they?| | |
How do you manage and control access to encryption keys? Who within your organization has access to these keys?| | |
Does your company use sub-processors or subcontractors?| | |