Vendor Security Questionnaire

Minimum security controls for subcontractors with CUI or system access include: documented information security policy; MFA for remote and privileged access; encrypted data in transit (TLS 1.2+) and at rest; vulnerability management with critical patch SLAs of 15 days; incident notification to Aegis within 24 hours of confirmed incidents; and willingness to flow down DFARS 252.204-7012 / CMMC obligations. Subcontractors without these controls cannot process CUI.

Vendors provide SOC 2 Type II or equivalent, penetration test summary (within 12 months), and a data flow diagram. Residual risks are accepted only by the CISO.