1-Exhibit D- UH Hosted Cybersecurity TC Amendment - 7Jun2023.pdf
PDF 125 KB Posted
- Attached to
- On Call Solution & Schedule Management System State and local contract opportunity
- Solicitation number
- RFP-225-08-044-SVC
- Issued by
- Bexar County, Texas
About this file
This document is a Cybersecurity Standard Terms and Conditions Amendment from University Health (Bexar County Hospital District) for vendors and service providers. The amendment outlines specific cybersecurity requirements for sellers engaging with University Health, including mandatory annual network and application penetration testing by an independent third party. The testing must cover potential unauthorized internet access, role compromises, and privilege escalation, with sellers required to provide an executive summary of test results and confirm remediation of critical and high-risk findings.
The amendment mandates that sellers comply with current network and device security guidelines consistent with standards from organizations such as ISO, IEC, OWASP, SANS Institute, and NIST. Sellers are prohibited from using offshore assets to work on buyer's data and must adhere to University Health's security policies when accessing their network. Non-compliance constitutes a material breach that could result in contract termination. For Seller-hosted sites, an annual SOC Type II report must be submitted to the buyer, emphasizing the comprehensive cybersecurity expectations for vendors working with University Health.
View the file
Other files for this state and local contract opportunity
| File | Type | Posted |
|---|---|---|
| 5-Exhibit E- IT Security Questionnaire V16.docx | DOCX document | |
| 2-Exhibit C-UH Cybersecurity TC Amendment - 7Jun2023.pdf | ||
| 3-Exhibit A- Standard Purchase Terms and Conditions 072825.pdf | ||
| 4-EXhibit B- Terms and Conditions State-County Law Amendment 5-15-24.pdf | ||
| 6-RFP-225-08-044-SVC Master Solicitation Document.pdf |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Revised 06/07/2023 1
CYBERSECURITY STANDARD TERMS AND CONDITIONS AMENDMENT
The provisions set forth in this Amendment are being added to the Agreement to comply with the Bexar
County Hospital District d/b/a University Health (“Buyer”) in its status as the County Hospital. This
Amendment shall apply and shall supersede any provisions in the Agreement (which includes any document referenced therein or subsequent agreements or subsequent amendments) to the contrary. For purposes of this
Amendment, "Seller" shall mean any bidder, offeror, vendor, service provider or other person or entity responding to this procurement opportunity or has entered into an agreement with Buyer.
1. CYBERSECURITY:
a. Seller shall contract, as part of its security program and on at least an annual basis, with an independent third party to conduct a network and application penetration test. The penetration test will include, but is not limited to, the potential for unauthorized internet access, compromise of roles, and escalation of privileges for the Application. Upon request, Seller will provide an executive summary of said penetration test including scope and methodology of the test and confirmation that critical and high-risk findings have been remediated or a plan (including time frame) is in place to remediate. Penetration testing includes the web application vulnerabilities defined by the Open Web Application Security Project (OWASP) Top 10 and those listed in the
SANS 25 (as applicable) or its successor current at the time of the test. If the site is Seller-hosted, a
SOC Type II report will be submitted to buyer annually. NOTE: Seller shall not employ offshore assets to work on buyer’s data. Seller shall not send buyer’s data offshore.
b. Seller shall comply with all reasonable security practices required by the provider that are consistent with current network and device security guidelines and best practices including those developed and implemented by the provider or as published by standards bodies such as the International
Organization for Standardization (ISO) and the International Electrotechnical Commission(IEC) (
ISO/IEC), the Association for the Advancement of Medical Instrumentation (AAMI), the Open
Web Application Security Project( OWASP), The SANS Institute, the Center for Internet Security and the National Institute of Standards and Technology (NIST). at its own cost.
c. Seller shall abide by Buyer’s security policies and practices, when Seller is provided access to
Buyer’s owned or controlled network.
d. Failure to abide by the above terms shall constitute a material breach that shall give the University
Health the right to terminate this Contract in accordance with the terms of the Agreement.
Vendor Signature Date Horacio Vasquez, MHA, CMRP Date
Executive Director of Supply Chain Services
University Health
File details come from the government source that posted it. Updated .