Reactforce | Cybersecurity. Business. Resilience.

Completion Instructions

Complete all fields in the Vendor Information section below.

For each question, select Yes, No, or N/A.

Use the Evidence / Comments field to support your response — especially where explanation is requested.

Attach supporting documentation where referenced (SOC 2, pen test, BCP attestation, etc.).

An authorized representative must complete and submit the Attestation at the end.

Return to your designated CAHP Credit Union contact securely.

Vendor Information

Legal Company Name * Required

DBA / Trade Name (if different)

Primary Business Address

Website

Date Completed *

Authorized Representative Name *

Title / Role

Phone Number

Email Address *

CAHP Contact / Engagement Reference

Nature of Services Provided to CAHP

Data Accessed / Processed

Member PII Financial Data Auth Credentials Internal CAHP Data None

Estimated Number of CAHP Records

Vendor Tier (CAHP Use Only)

Sub-processors / Fourth Parties Used?

Yes — listed in comments No

1. Data Governance & Privacy

Q1–5

# Question	Response	Evidence / Comments

2. Data Location & Storage

Q6–9

# Question	Response	Evidence / Comments

3. People & Access Controls

Q10–14

# Question	Response	Evidence / Comments

4. Devices & Endpoint Security

Q15–19

# Question	Response	Evidence / Comments

5. Network Security

Q20–25

# Question	Response	Evidence / Comments

6. DNS & DDoS Protection

Q26–27

# Question	Response	Evidence / Comments

7. Vulnerability & Patch Management

Q28–32

# Question	Response	Evidence / Comments

8. Application Security

Q33–36

# Question	Response	Evidence / Comments

9. Security Monitoring & SOC

Q37–40

# Question	Response	Evidence / Comments

10. Your Vendor Risk Management (Fourth-Party)

Q41–44

# Question	Response	Evidence / Comments

11. Incident Response

Q45–49

# Question	Response	Evidence / Comments

12. Business Continuity & Disaster Recovery

Q50–54

# Question	Response	Evidence / Comments

13. Assessments, Audits & Penetration Testing

Q55–58

# Question	Response	Evidence / Comments

14. Compliance & Certifications

Q59–61

# Question	Response	Evidence / Comments

15. Cybersecurity Governance

Q62–65

# Question	Response	Evidence / Comments

16. Authentication & Password Security

Q63–65

# Question	Response	Evidence / Comments

17. Access Control

# Question	Response	Evidence / Comments

18. Security Awareness & Training

# Question	Response	Evidence / Comments

19. Data Security & Breach History

# Question	Response	Evidence / Comments

20. Insurance

# Question	Response	Evidence / Comments

21. Artificial Intelligence (AI) Governance

# Question	Response	Evidence / Comments

22. Material Change Notification

# Question	Response	Evidence / Comments

Vendor Attestation & Signature

By signing below, the authorized representative of the vendor organization attests that the information provided in this questionnaire is accurate and complete to the best of their knowledge, and that the vendor organization will promptly notify CAHP Credit Union of any material changes to the information provided.

The information provided in this questionnaire is true, accurate, and complete to the best of my knowledge.
I am authorized to provide this information on behalf of my organization.
My organization will notify CAHP Credit Union within 24 hours of any confirmed or suspected incident affecting CAHP data.
My organization will notify CAHP Credit Union of material changes to this questionnaire's responses within 30 days of such change.

Authorized Representative Signature

Printed Name & Title

Company Name

Date

CAHP Credit Union — Third-Party Risk Management Program
Return completed form securely to your designated CAHP contact. Version 2.0 · March 2026.