09-Appendix C Information & System Security Reqs.docx

APPENDIX C

INFORMATION AND SYSTEM SECURITY REQUIREMENTS

This Appendix C is attached to and made a part of the contract, quote, terms and conditions, purchase order, or other ordering document (“Agreement”) between Roswell Park Cancer Institute Corporation d/b/a Roswell Park Comprehensive Cancer Center (“Roswell Park”) and the vendor identified in the Agreement (“Vendor”). Capitalized terms used but not defined in this Appendix C shall have the meanings assigned to them in the Agreement.

1. DEFINITIONS.

1.1 “Authorized User” means an employee or Subcontractor of Vendor.

1.2 “B2B Connection” means a site-to-site connection established between Vendor and Roswell Park.

1.3 “BAA” means the Business Associate Agreement between Roswell Park and Vendor.

1.4 “Cardholder Data” means as defined under the PCI DSS.

1.5 “Disabling Device” means any software, program, mechanism, programming device, or other computer code designed, or that could reasonably be used by Vendor or any third party, to modify, delete, disrupt, disable, harm, or otherwise impede the operation, or permit unauthorized access to or tracking, of any software, code, computer system, or computer network and associated hardware.

1.6 “Environment” means the Roswell Park instance of the SaaS Product.

1.7 “Material Threat” means any security issue, threat, or deficiency that has a reasonable likelihood of materially harming the security, integrity, or availability of Roswell Park Data, Roswell Park Technology, or Roswell Park’s network operations, including without limitation any compromise or fraudulent imitation of Vendor’s domain accounts.

1.8 “NIST” means the National Institute of Standards and Technology.

1.9 “Network Connection” means a Roswell Park-chosen connection method to Roswell Park Technology, which may be a B2B Connection.

1.10 “Nonpublic Information” means as defined in 10 NYCRR § 405.46.

1.11 “PCI DSS” means the Payment Card Industry Data Security Standard.

1.12 “PHI” means as defined in 45 CFR § 160.103.

1.13 “Private Information” means as defined in New York General Business Law § 899-aa(1)(b).

1.14 “Product” means the equipment, software, or other product provided by Vendor under the Agreement.

1.15 “Roswell Park Data” means, collectively, PHI, Private Information, and electronic information that Roswell Park otherwise determines constitutes Nonpublic Information.

1.16 “Roswell Park Technology” means, collectively, computers, equipment, devices, networks, applications, and other information technology or systems owned, leased, or controlled by Roswell Park, including the Roswell Park-controlled portions of a B2B Connection.

1.17 “SaaS” means software-as-a-service.

1.18 “Services” means the services provided under the Agreement, including, as applicable, the provision of one or more Products.

1.19 “Subcontractor” means any subcontractor, consultant, or agent, whether a third party or affiliate of Vendor, utilized by Vendor to perform any portion of the Services.

1.20 “Vendor Technology” means, collectively, computers, equipment, devices, equipment, hosting environments, networks, applications, or other information technology or systems owned, leased, or controlled by Vendor, including the Vendor-controlled portions of a B2B Connection.

2. SCOPE. This Appendix C supplements any confidentiality and security requirements set forth elsewhere in the Agreement and, to the extent applicable, the requirements set forth in the BAA. Vendor shall comply with this Appendix C when the Services involve Vendor accessing, receiving, storing, or transmitting Roswell Park Data or remotely accessing Roswell Park Technology.

3. USE OF SUBCONTRACTORS. Vendor’s utilization of Subcontractors shall be in accordance with and subject to any authorizations or restrictions set forth in the Agreement, and Vendor shall ensure that each Subcontractor complies with all applicable terms and conditions of this Appendix C as they apply to Vendor. Use of Subcontractors shall not relieve Vendor of any liability or obligation under the Agreement.

4. VENDOR’S SECURITY PROGRAM AND PRACTICES.

4.1 Applicable Law. Vendor shall comply with all applicable laws and regulations governing the confidentiality, privacy, security, integrity, and availability of Roswell Park Data and Roswell Park Technology.

4.2 Security Program. Vendor represents and warrants that it will use industry standard data security protocols and procedures to protect Vendor Technology and will implement security measures and appropriate technical and organizational measures designed to detect and prevent security incidents and unlawful or unauthorized: (i) access to or transmittal or exfiltration of Roswell Park Data; and (ii) access to or use of Roswell Park Technology; including intrusions by a Disabling Device and the use of Vendor’s computer systems or network devices to communicate, induce, attack, or compromise Roswell Park. Vendor further represents and warrants that it will provide regular cybersecurity awareness training for its personnel, including without limitation annual phishing exercises, and establish, maintain, and test (at least annually) an industry standard incident response plan that addresses actual or suspected incidents or breaches of data security, integrity, and availability. Vendor’s security programs shall align and be enforced in accordance with industry standard frameworks such as NIST Cybersecurity Framework, HITRUST, ISO27001, and CSA Cloud Controls Matrix.

4.3 Patch Management, Application-Level Security, and Penetration Testing. With respect to Vendor Technology used to access, store, or transmit Roswell Park Data or to access Roswell Park Technology, Vendor shall: (i) implement and enforce a formal patch management program, reasonable application-level security controls such as authentication timeout, code integrity monitoring, and vulnerability scanning; (ii) deploy antivirus and endpoint protection technologies; and (iii) conduct annual penetration testing. Such penetration testing shall: (a) be conducted by qualified individuals and consistent with industry standards; and (b) include, at a minimum, attempts to circumvent or defeat security features from inside and outside of the Vendor Technology, probes for weaknesses in perimeters and process or technical countermeasures that could be exploited by a malicious party, and quarterly systematic scans reasonably designed to identify cybersecurity vulnerabilities. Within thirty (30) calendar days of written request by Roswell Park, Vendor agrees to provide Roswell Park with an attestation of completion of, and executive summary of findings pertaining to, Vendor’s most recent penetration testing.

4.4 Designated Security Lead. Vendor shall identify for Roswell Park the qualified individual Vendor has designated as responsible for overseeing the implementation and enforcement of Vendor’s security program as well as the individual, if different, who will serve as Vendor’s primary point of contact for Roswell Park regarding cybersecurity matters.

5. PRODUCT SECURITY.

5.1 Application Security. If the Product is a Vendor-developed application, then Vendor represents and warrants that, throughout the term of the Agreement, it will adhere to industry standard secure software development frameworks and best practices such as the Open Web Application Security Project’s (OWASP) Top 10 secure coding principles and NIST Secure Software Development Framework, and implement reasonable application-level security controls within the Product such as authentication timeout, code integrity monitoring, and vulnerability scanning.

5.2 SaaS Products. If the Product is a SaaS product, then:

5.2.1 Database-Level Security Controls. Vendor shall implement appropriate database-level security controls to safeguard Roswell Park Data within the Product, including, without limitation, encryption at rest using Transparent Data Encryption, logical separation of production and non-production environments, and timely application of security patches to database systems.

5.2.2 Multi-tenancy Control. If Vendor utilizes a multi-tenant cloud environment, Vendor agrees to implement security procedures and technologies designed to prevent unauthorized parties from gaining access to Roswell Park Data. Vendor shall ensure that data seizures or breaches from other tenants do not impact the confidentiality, integrity, or availability of Roswell Park Data.

5.2.3 Restricted Access. To the extent applicable, Vendor shall implement security features/technology designed to restrict access to the Environment to authorized Roswell Park users, only (e.g., multifactor authentication, Security Assertion Markup Language integration, IP restriction). No other clients of Vendor shall have access to the Environment without Roswell Park’s written approval and Vendor shall access the Environment only when needed to perform the Services.

5.3 Disabling Device Warranty. Vendor represents and warrants that: (i) as of the later of the date of delivery, installation, or implementation, the Products do not contain any Disabling Device; (ii) as of the effective date of the Agreement, all Vendor Technology used to access, store, or transmit Roswell Park Data or to access Roswell Park Technology are free from Disabling Devices; and (iii) throughout the term of the Agreement, Vendor will not knowingly introduce, and will use commercially reasonable efforts to prevent the introduction of, a Disabling Device into any Roswell Park Data, Roswell Park Technology, or Vendor Technology.

6. VENDOR’S OBLIGATIONS WITH RESPECT TO ROSWELL PARK DATA.

6.1 Authorized Users. Vendor shall permit only its Authorized Users to use Roswell Park Data and to the minimum extent necessary to perform the Services. Vendor acknowledges and agrees that, except as specifically permitted herein, Authorized Users shall not commercially exploit or attempt to: (i) modify, decompile, disassemble, reverse engineer, remove, alter, or duplicate Roswell Park Data; or (ii) disclose, sell, assign, lease, or otherwise dispose of Roswell Park Data to any third party (including to an affiliate).

6.2 Ownership. The parties agree that: (i) except as specifically stated otherwise in the Agreement, between the parties, Roswell Park Data (including all rights therein and related thereto) is and shall remain the sole and exclusive property of Roswell Park; and (ii) no ownership or intellectual property rights to Roswell Park Data are granted to Vendor under this Appendix C.

6.3 Encryption. In addition to the applicable SaaS-specific requirements set forth in Section 5.2 above, Vendor shall encrypt all Roswell Park Data in transit and at rest (including Roswell Park Data maintained in back-ups) using an encryption solution that meets, at a minimum, NIST guidance and is Federal Information Processing Standards 140-3 (or higher)-validated. For the avoidance of doubt, Vendor shall not transmit any unencrypted Roswell Park Data and shall not store any Roswell Park Data except where there is a business necessity pursuant to the Agreement or a legal necessity pursuant to applicable law.

6.4 Payment Card Industry Compliance. To the extent that Vendor uses, discloses, creates, receives, hosts, stores/maintains, transmits, or otherwise accesses Cardholder Data of Roswell Park or its patients pursuant to the Agreement, Vendor shall: (i) abide by the PCI DSS; and (ii) provide to Roswell Park a valid PCI DSS Attestation of Compliance upon the effective date of the Agreement and every year thereafter throughout the term of the Agreement.

6.5 Expiration and Termination Procedure. Upon expiration or termination of the Agreement, Vendor shall, as instructed by Roswell Park: (i) permanently remove Roswell Park Data in Vendor’s possession or control in a manner meeting forensic industry standards no less stringent than the “destroy” standard set forth in NIST Special Publication 800‐88 Guidelines for Media Sanitization; and/or (ii) return or migrate Roswell Park Data in Vendor’s possession or control to a platform-agnostic format that maintains its confidentiality, integrity, and availability. In the event that the parties agree that return and/or destruction of all or a portion of the Roswell Park Data in Vendor’s possession or control is/are infeasible or retention is required by applicable law, Vendor may retain such Roswell Park Data for so long as the return or destruction remains(s) infeasible or the retention is required by law, provided that Vendor extends the protections of this Appendix C to the Roswell Park Data for so long as the Roswell Park Data is retained and limits further use of the Roswell Park Data to those purposes that make the return and/or destruction infeasible or required by law.

7. VENDOR’S OBLIGATIONS WITH RESPECT TO ROSWELL PARK TECHNOLOGY.

7.1 Network Connections. Vendor shall only permit its Authorized Users to remotely access Roswell Park Technology, which shall be only through Network Connections.

7.2 Vendor Policies and Controls. With regard to the components of a Network Connection controlled, and accounts provisioned, by Vendor, Vendor shall implement policies and technical controls to ensure that: (i) only Authorized Users access Roswell Park Technology and solely to perform the Services; (ii) Authorized User access follows role-based access control principles and is limited to the minimum necessary for each Authorized User’s role; (iii) each Authorized User has a separate ID, with access permissions appropriate to that individual’s role; (iv) passwords are required to be changed according to industry practices; (v) each Authorized User is prohibited from sharing IDs and passwords or permitting anyone else to log on with his or her unique ID and password; and (vi) Authorized Users do not, except as required to perform Services, edit, manipulate, copy, save, print, screenshot, cut and paste, download, or otherwise transfer Roswell Park Data from Roswell Park Technology.

7.3 Security and Technical Controls. Neither Vendor, nor any Authorized User, shall, or shall attempt to, modify, decompile, disassemble, reverse engineer, remove, alter, circumvent, or duplicate any technical controls used by either party to secure the Network Connection. If a Network Connection becomes vulnerable, unsupported, obsolete, or otherwise fails to comply with Roswell Park security standards, as determined by Roswell Park in its sole discretion, Roswell Park may require Vendor to use an alternate Network Connection.

8. AUDITING RIGHTS AND RESPONSIBILITIES.

8.1 Auditing Vendor’s Privacy and Security Programs. Roswell Park shall have the right to review Vendor’s privacy and security programs at any time. Additionally, upon written request, Vendor shall: (i) provide Roswell Park with its (and its Subcontractors’, as applicable) most recent SSAE-18 SOC-2 Type II report, ISO 27001 Certification, or HITRUST Alliance Common Security Framework validated assessment (as applicable); and (ii) return a completed information security assessment questionnaire provided by Roswell Park regarding Vendor’s (and its Subcontractors’, to the extent applicable) privacy and security programs. Vendor shall, and shall cause its Subcontractors to, respond to these inquiries within a reasonable period, which shall be no later than fifteen (15) business days after receipt.

8.2 Auditing Access to Roswell Park Technology. Roswell Park shall further have the right to monitor and audit all access to Roswell Park Technology and all aspects of each Network Connection. With respect to access controlled by Vendor, Vendor shall maintain audit reports showing login entries and system access logs that include timestamps, user identifiers, and access actions. Such reports shall be made available to Roswell Park upon request and be retained by Vendor for a minimum of one (1) year. Roswell Park reserves the right to investigate any irregularities in any such reports, including any unauthorized or suspicious activity, and Vendor shall reasonably cooperate with any such investigation.

9. NOTICE OF MATERIAL THREATS. Vendor shall notify Roswell Park via email at informationsecurityteam@roswellpark.org as promptly as possible, but in no event later than seventy-two (72) hours, upon discovery of a Material Threat. Vendor shall take immediate action to address each Material Threat. If Vendor fails to promptly notify Roswell Park of a Material Threat or is unable to resolve a Material Threat to Roswell Park’s reasonable satisfaction within a period agreed to both parties, Roswell Park shall have the right to suspend access to Roswell Park Technology and Roswell Park Data and terminate the Agreement without liability.

10. OFFSHORING. Vendor is prohibited from accessing, receiving, storing, or transmitting Roswell Park Data, and accessing any Roswell Park Technology, outside of the United States.

11. DISCLAIMER OF ALL WARRANTIES. ROSWELL PARK HEREBY DISCLAIMS ANY AND ALL WARRANTIES WITH RESPECT TO THE NETWORK CONNECTION(S), ROSWELL PARK TECHNOLOGY, AND ROSWELL PARK DATA, INCLUDING ANY WARRANTIES OF ACCURACY, AVAILABILITY, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR FREEDOM FROM INFRINGEMENT OF A THIRD PARTY’S INTELLECTUAL PROPERTY RIGHT(S). ROSWELL PARK FURTHER DISCLAIMS ANY WARRANTIES THAT THE NETWORK CONNECTION(S) WILL BE UNINTERRUPTED OR ERROR FREE.

12. CONFLICTING TERMS. In the event of a conflict between the terms of this Appendix C and any other provision of the Agreement, the terms of this Appendix C shall prevail. Notwithstanding the foregoing, Roswell Park Data that is PHI may be subject to additional or more restrictive requirements as set forth in the BAA, and, accordingly, in the event of a conflict between the terms of this Appendix C and the terms of the BAA, the terms of the BAA shall prevail.