03.APPENDIX C_Hosting_Requirements.docx

Appendix C:

Physical Hosting Requirements at-a-Glance

This appendix (Appendix C: Physical Hosting Requirements at-a-Glance) outlines the State of South Dakota’s comprehensive physical hosting requirements that vendors must meet when providing data center and facility‑level services. It consolidates the governance, security, environmental, operational, resiliency, and auditing expectations defined by BIT policies and aligned federal frameworks such as NIST SP 800‑53 and FedRAMP, establishing baseline controls for physical security, access management, power and cooling redundancy, network connectivity, incident response, business continuity, and reporting obligations. The requirements ensure that any facility housing State equipment or data maintains rigorous safeguards, adheres to State procurement and contractual obligations, and demonstrates the operational maturity needed to protect critical infrastructure throughout the full system lifecycle—from onboarding and daily operations to decommissioning and exit.

Key State Guidance Documents

· BIT Information Technology Security Policy – Contractor: Core security obligations for contractors hosting or handling State data and equipment.

· BIT Standards & Standards Overview (BIT portal): Catalog and navigation for State standards (security, identity/SSO, server hardware/software, vendor & client security requirements).

· ESM/OPM Procurement Portal & Cloud Services MSAs/RFPs: Guidelines for how vendors are to engage with the State during the RFP process.

· NIST SP 800‑53B Control Baselines (Rev 5.2) & FedRAMP Program: Baseline expectations for government systems; commonly applied for State workloads.

Note: Where the BIT policy is explicit, it governs. Where BIT is not prescriptive, the State typically aligns to NIST SP 800‑53 baselines and FedRAMP practices proportionate to system impact.

1. Governance & Contractual Requirements

1.1 Procurement Channel

Vendor participation and bidding must occur through the State’s ESM Source/Easy Purchase (OPM) portal.

1.2 Master Agreement & Statements of Work

Vendor must execute the applicable BIT Master Service Agreement for IT services; other State agencies may issue SOWs under the MSA.

1.3 BIT Policies

The vendor must comply with BIT Information Technology Security Policy – Contractor and all referenced standards. These requirements apply to physical data center hosting and environmental controls.

1.4 Facility Hosting Agreement

The agreement must define scope, roles, responsibilities, SLAs for power/cooling, physical access, and processes for termination and equipment removal.

2. Security Requirements

2.1 Minimum Control Frameworks

Vendor must implement and evidence controls aligned to NIST SP 800‑53 Rev.5; tailor to impact level using SP 800‑53B baselines, and BIT Information Technology Security Policy.

2.2 Regulatory Overlays

HIPAA, IRS Pub 1075/FTI, PCI DSS, Gov Ramp, CJIS/FBI, and any federal/state physical protections referenced by BIT must be followed.

2.3 Facility Access Control

Vendor must provide 24/7 controlled access, visitor escorting, access logging, and periodic access recertification.

2.4 Surveillance & Monitoring

Continuous CCTV monitoring covering entry points and racks, with a minimum 180-day retention of footage.

2.5 Data Center Security Controls

Two-factor authentication, mantraps, controlled dock areas, and rack-level locking upon State request.

2.6 Privacy, Background Checks, & Personnel

Limit physical and logical access to authorized, trained staff; maintain access attestation records. Adhere to BIT mandates for background checks when a person may be in the presence of State equipment.

2.7 Third‑Party/Subservice (Supply Chain)

Disclose all subservice organizations; ensure they meet the same controls and requirements and can provide SOC reports/ACRs on request.

3. Environmental Protections

3.1 Power

Minimum redundant AC high power feeds, generator backup, UPS systems, and power usage monitoring.

3.2 Cooling

Minimum redundant HVAC systems, temperature and humidity monitoring, and alerting for threshold breaches.

3.3 Fire Detection & Suppression

Pre-action, dry fire suppression system, smoke/heat detection, and real-time alerting.

4. Network & Connectivity

4.1 Cross‑Connects

Vendor maintains published cross‑connect options to other customers, carriers, and vendors inside the data center facility, pricing, and installation SLAs.

4.2 Carrier Access

Supplies an up‑to‑date list of on‑site carriers and coordinates circuit delivery to the State's rack.

4.3 Cable Pathways

Documents available cable pathways and any shared‑space restrictions and supports diverse physical paths to enable State‑requested redundancy. Fiber and copper pathways must be separated.

4.4 Facility Network Infrastructure

Provides diagrams of any facility‑managed patch points used by State connections and issues alerts for conditions and maintenance that could impact connectivity.

5. Operational Support & Monitoring

5.1 Remote Hands

Vendor power cycling, visual inspections by customer request, and other basic tasks with defined SLAs.

5.2 Change Management

Vendor must notify the State of any facility-level changes affecting equipment.

5.3 Incident Response

Notification required for power issues, HVAC failures, security incidents, environmental alarms (fire, flooding, temperature/humidity, etc.), and severe weather events.

6. Resiliency & Business Continuity

6.1 Facility-Level Resilience

Vendor must maintain and share with the State a facility-level and internal infrastructure resiliency, including Disaster Recovery plans for power, cooling, and fire suppression, with annual testing and testing results.

6.2 Incident Notification & Triage

Negotiate triage and containment SLAs; notify BIT within contractual windows for suspected compromise and support for BIT-led forensic access and investigation.

7. Auditing & Reporting

7.1 Internal Auditing

Vendor must supply SOC 1/SOC 2 reports, logs, Disaster Recovery test results, and incident reports.

7.2 Audit, Evidence, & Reporting

Permit State or designated auditors to review security posture; provide SSP, policies, diagrams, test results, POA&Ms, and continuous monitoring artifacts.

8. Asset Management & Rack Space

8.1 Space Allocation

Vendor provides rack space, power outlets, weight/load confirmation, structured cabling, raised floor environment, and HVAC ducting.

8.2 Delivery & Installation Support

Vendor supports secure equipment in-person and mail delivery at onboarding and ad hoc for future equipment replacements, secure temporary storage, customer delivery alerts, verification, and escorting procedures.

9. Decommissioning & Exit Requirements Vendor accompanies State during equipment removal, disables access immediately, and certifies complete removal.

10. Summary Table

11. Submission Package Expectations for Vendors Procurement Compliance: Registration and bidding through State OPM/ESM; adherence to BIT MSA/SOW constructs.

Completed RFP Appendices Submitted with Proposal (Required) :

· Appendix B: Security and Vendor Questionnaire

· Appendix D: Qualifications and Experience

· Appendix E: Cost Analysis

· Appendix F: Evaluation Criteria

Required Proposal Documentation Inclusions:

· Resumes and References of Key Personnel

· Security Program Artifacts: SSP (or equivalent), policy set, network/data flow diagrams, control mappings to NIST/FedRAMP, and compliance certificates (HIPAA/PCI/IRS) as applicable.

· Operational Procedures: IRP, BCP/DRP with last test results; patching/vulnerability processes; change management workflows.

· Third‑Party Disclosures: Subservice providers' list, SOC reports/ACRs, data residency statements.

· Service Definition & SLAs: Availability, performance, incident response, recovery SLAs; monthly reporting format; service credit model.

· Service and Pricing Catalog(s): Documentation of standard, featured, itemized, and optional services, price tiers, fee structures, and/or other cost artifacts.