1-Exhibit J.6 OCISO.pdf
PDF 93 KB Posted
- Attached to
- Photo and ID Card
- Solicitation number
- 696-BF-26-O033
- Issued by
- Texas
About this file
This is an Office of the Chief Information Security Officer (OCISO) exhibit detailing standard cybersecurity and data security terms for a contract with the Texas Department of Criminal Justice (TDCJ) to provide a Photo and ID Card solution. The exhibit establishes mandatory security requirements and compliance obligations for the contractor and any subcontractors involved in producing digitally printed color identification cards for employees and inmates, as well as storing and retrieving inmate mug shots through a web-based platform.
The contractor must comply with federal and state laws, the TDCJ Information Resources Security Program (IRSP) based on NIST 800-53 standards, and obtain Texas Risk and Authorization Management Program (TX-RAMP) certification for applicable cloud services. All contractor staff with system or data access must complete cybersecurity training and sign the TDCJ EMPL3 Data Use and Non-Disclosure Agreement. The contractor is required to implement secure IP communications with authentication and encryption for all system components, encrypt all department data in transit and at rest, maintain current firmware and security patches, and conduct security vulnerability scanning. The contractor must provide an independent security assessment report confirming no vulnerabilities exist, perform penetration testing on mobile applications and public-facing websites before deployment, notify the department of supply chain compromises within 24 hours and security incidents within 6 hours of discovery, contain and mitigate incidents within 30 hours, and properly dispose of department data according to TDCJ standards. The department retains the right to conduct security penetration testing and request assessment or audit results for continuous monitoring purposes.
View the file
Other files
Show all 14
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
696-BF-26-O033 Exhibit J.6
Office of the Chief Information Security Officer Standard Terms
A. The Contractor is responsible for following all federal and state laws as well as the Information Resources Security Program (IRSP), the Department’s security policy based on NIST 800- 53.
B. If applicable, cloud services must be Texas Risk and Authorization Management Program (TX-RAMP) certified. The Department shall determine applicability based on the data classification and impact level of the information resource and in consultation with the Department of Information Resources (DIR). The TX-RAMP Program Manual can be found at https://dir.texas.gov/resource-library-item/texas-risk-and-authorization-management-program-manual-30.
C. All Contractor, including any subcontractors, must complete the Department’s Cybersecurity Training Course if they require access to Department systems or data.
D. All Contractor staff, including any subcontractors, with access to Department systems, data, or proprietary information, must agree to and sign the TDCJ EMPL3 form, Data Use and Non- Disclosure Agreement.
E. All deliverables within this Contract are subject to security vulnerability scanning by the Department’s Office of the Chief Information Security Officer (OCISO). Any vulnerabilities found must be corrected on a schedule based on the criticality of the vulnerability.
F. The Department shall perform security penetration testing of the system or application as the Department deems necessary. Any shortcomings identified through the security penetration testing shall be resolved within 30 Days of the results being submitted in writing to the Contractor.
G. The Contractor shall furnish a recent independent report from a certified contractor for network and program security, noting that no vulnerabilities were found for all components of the system or application.
H. Each version of any mobile application or public-facing website that stores or processes confidential or sensitive information must undergo a security penetration test before going live.
Any shortcomings identified during the testing must be resolved before the version goes live.
I. The Contractor shall notify the Department within 24 hours of any supply chain compromises.
Supply chain compromise means confirmed or suspected unauthorized access or tampering impacting confidentiality, integrity, or availability of Department data or systems.
J. The Contractor shall notify, in writing, the Department OCISO of a security incident, including but not limited to cybersecurity breaches, or suspected cybersecurity breaches, within six hours of discovery. Discovery means the point at which the Contractor has a reasonable basis to conclude that a security incident has occurred.
K. The Contractor shall contain and mitigate a security incident within 30 hours of discovery and shall provide a corrective action plan for full remediation if resolution cannot be completed within that timeframe.
https://dir.texas.gov/resource-library-item/texas-risk-and-authorization-management-program-manual-30 https://dir.texas.gov/resource-library-item/texas-risk-and-authorization-management-program-manual-30
696-BF-26-O033 Exhibit J.6
L. At the request of the Department, the Contractor shall submit the results of any assessments or audits for the purpose of continuously monitoring the Contractor.
M. The Contractor shall provide secure Internet Protocol (lP) communications by authenticating and encrypting each lP packet of a communication session for all components of the system or application.
N. The Contractor shall provide firmware updates, application updates, and security testing for all components of the system or application.
O. The Contractor shall promptly install all relevant security patches and anti-virus updates on the Contractor's network.
P. The Contractor shall ensure all Department data, information, or records shall be encrypted in transit and at rest according to the TDCJ IRSP, and the Department’s security policy based on NIST 800-53.
Q. The Contractor shall dispose of any Department data, documentation, tools, or system components according to the TDCJ IRSP using established and approved techniques and methods based on the level of confidentiality.
File details come from the government source that posted it. Updated .