0- MPS- Exhibit G- OIT Security Requirements- BW- FINAL- v11-2014-bb.pdf
PDF 124 KB Posted
- Attached to
- Managed Print Services - Statewide
- Solicitation number
- RFP AAEA 2015000104 5
- Issued by
- Denver County, Denver City, Colorado
About this file
This document is an exhibit of IT Security Requirements established by the Colorado Governor's Office of Information Technology (OIT) that applies to all vendors and contractors providing goods or services to State of Colorado agencies. The requirements mandate contractor compliance with state information security policies and establish baseline standards across multiple security domains. Contractors must maintain network security including firewalls, intrusion detection, and bi-annual third-party vulnerability assessments; implement application security consistent with OWASP Top Ten or CWE/SANS Top 25 standards; preserve confidentiality, integrity, and accessibility of state data through administrative, technical, and physical measures; and ensure all electronic data transmission occurs via secure protocols such as HTTPS or SFTP. All state data must remain stored and processed within United States facilities unless explicitly waived by the Colorado Attorney General's Office.
Additional requirements include encryption of all backup data and personally identifiable information using minimum 128-bit symmetric or 1024-bit asymmetric encryption keys; restriction of data use solely to contract-specified purposes with prohibition against distribution or repurposing across business units; and complete data destruction and certification within 30 days of contract termination or seven days of written state request, whichever occurs first. Contractors must comply with breach notification laws and notify the state within 24 hours of any security incident while assuming full responsibility for individual notification and indemnifying the state against related claims. The state reserves the right to conduct audits with a minimum two weeks' notice, which may be conducted by state personnel or external audit firms; contractors with certified Type II SAS 70 reviews may satisfy audit requirements through documentation review. All audits are conducted at contractor expense, and security standards are benchmarked against recognized industry frameworks including Center for Internet Security, NIST, PCI/DSS, FISMA, ISO/IEC 27000-series, and OASIS standards.
View the file
Other files
Show all 16
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Exhibit G
Office of Information Technology (OIT) - IT Security Requirements
The Colorado Governor’s Office of Information Technology (OIT) requires all vendors, who submit proposals and Contractors who are awarded contracts to provide goods and/or services to State Agencies, to comply with its IT Security Requirements. The following are a synopsis of such requirements.
1. Security Provisions.
The Contractor shall be familiar with and comply with all State Of Colorado Information Security Policies which can be found here: http://www.colorado.gov/cs/Satellite/OIT-Cyber/CBON/1251575408771
2 Network Security.
Contractor shall maintain network security that, at a minimum, includes network firewall provisioning, intrusion detection, and regular (two or more annually) third party vulnerability assessments. Contractor shall maintain network security that conforms to generally recognized industry standards and best practices that Contractor then applies to its own network.
3. Application Security.
Contractor shall provide, maintain, and support its Software and subsequent updates, upgrades, and bug fixes such that the Software is, and remains secure from those vulnerabilities as described in:
a) The Open Web Application Security Project’s (OWASP) “Top Ten Project” – see http://www.owasp.org; or
b) The CWE/SANS Top 25 Programming Errors - see http://cwe.mitre.org/top25/ or http://www.sans.org/top25-programming-errors/; or
c) Other generally recognized and comparable industry practices or standards.
4. Data Security.
Contractor shall preserve the confidentiality; integrity and accessibility of State data with administrative, technical, and physical measures that conform to generally recognized industry standards and best practices that Contractor then applies to its own processing environment. Maintenance of a secure processing environment includes, but is not limited to, the timely application of patches, fixes, and updates to operating systems and applications as provided by Contractor. All State Confidential Information and State data of any kind shall be stored, processed, or transferred only in or to facilities located within the United States except where specifically waived by approval from the Colorado Attorney General’s Office.
5. Data Transmission.
Contractor shall ensure that any and all electronic transmissions or exchange of system and application data with State and/or any other parties expressly designated by State shall take place via secure means (using HTTPS or SFTP or equivalent) and solely in accordance with “Data Re-Use” guidelines. Two-way network communication between the PC and the printing device is prohibited. The computer can communicate to the printer but the printer cannot "talk back" to the staff computers
6. Data Encryption.
Contractor shall store all State backup data as part of its designated backup and recovery processes in encrypted form, using a commercially supported encryption solution. Contractor shall ensure that any and all State data defined as personally identifiable information stored on any portable or laptop computing device or any portable storage medium is likewise encrypted. Encryption solutions will be deployed with no less than a 128-bit key for symmetric encryption and a 1024 (or larger) bit key length for asymmetric encryption.
7. Data Re-Use.
Contractor shall ensure that any and all data exchanged is used expressly and solely for the purposes enumerated in the awarded Contract. Data shall not be distributed, repurposed or shared across other applications, environments, or business units of Contractor. No State data of any kind shall be transmitted, exchanged or otherwise passed to other Contractors or interested parties except on a case-by-case basis as specifically agreed to in writing by the State.
http://www.colorado.gov/cs/Satellite/OIT-Cyber/CBON/1251575408771
8. End of Agreement Data Handling.
Contractor shall ensure that upon termination of an awarded Contract it shall erase, destroy, and render unrecoverable all State data and certify in writing that these actions have been completed within 30 days of the termination of such Contract or within 7 days of the written request of an agent of State, whichever shall come first. At a minimum, a “Clear” media sanitization shall be performed according to the standards enumerated by the National Institute of Standards, Guidelines for Media Sanitization, SP800-88.
9. Security Breach Notification.
Contractor shall comply with all applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification. In the event of a breach of any of Contractor’s security obligations, or other event requiring notification under applicable law, Contractor agrees to:
a. Notify State by telephone and e-mail to the designated State representative identified in the Contract of such an event within 24 hours of discovery, and
b. Assume responsibility for informing all such individuals in accordance with applicable law, and
c. Indemnify, hold harmless and defend State and its trustees, officers, and employees from and against any claims, damages, or other harm related to such Notification Event.
10. Right to Audit.
The State or an appointed audit firm (Auditors) has the right to audit the Contractor and the Contractor’s sub- Contractors or affiliates that provide a service for the processing, transport or storage of the State’s data. The State will announce their intent to audit the Contractor by providing at a minimum two weeks (10 business days) written notice (email is acceptable) to the Contractor. Such notice shall be sent to the designated Contractor’s and State’s representatives identified in the Contract. A scope document along with a request for deliverables will be provided at the time of notification of an audit. If the documentation requested cannot be removed from the Contractor’s premises, the Contractor shall allow the Auditors access to their site. Where necessary, the Contractor will provide a personal site guide for the Auditors while on site. The Contractor will provide a private accommodation on site for data analysis and meetings; the accommodation will allow for a reasonable workspace, with appropriate lighting, electrical, a printer and Internet connectivity. The Contractor will make necessary employees or subcontractors available for interviews in person or on the phone during the time frame of the audit. In lieu of State or its appointed audit firm performing their own audit, if the Contractor has an external audit firm that performs a certified Type II SAS 70 review, State has the right to review the controls tested as well as the results, and has the right to request additional controls to be added to the certified Type II SAS 70 review for testing the controls that have an impact on State data. Audits shall be at the Contractor’s sole expense.
6.11 Industry Standards.
Generally recognized industry standards include, but are not limited to, the current standards and benchmarks set forth and maintained by the:
a. Center for Internet Security - see http://www.cisecurity.org
b. Payment Card Industry/Data Security Standards (PCI/DSS) – see http://www.pcisecuritystandards.org/
c. National Institute for Standards and Technology - see http://csrc.nist.gov
d. Federal Information Security Management Act (FISMA) - see http://csrc.nist.gov
e. ISO/IEC 27000-series - see http://www.iso27001security.com/
f. Organization for the Advancement of Structured Information Standards (OASIS) – see http://www.oasis-open.org/
--- end ---http://www.oasis-open.org/
File details come from the government source that posted it. Updated .