10-Enterprise Technology Services Security Requirements Exhibit - Low Risk.pdf
PDF 49 KB Posted
- Attached to
- CrowdStrike Falcon Complete Software
- Solicitation number
- PNC2130366B1
- Issued by
- Broward County, Florida
About this file
This is a Security Requirements Exhibit for Enterprise Technology Services establishing technical and security standards for Broward County, Florida's procurement of the CrowdStrike Falcon Complete Endpoint and Identity Security Solution. The document defines requirements applicable to software, equipment, and platforms provided by contractors, specifically addressing low-risk implementations. The contract is structured as an open-end agreement enabling the Enterprise Technology Services Division and other Broward County agencies to procure the CrowdStrike solution and related services as needed in accordance with specified requirements and technical specifications.
The Security Requirements Exhibit establishes mandatory technical controls for contractor-provided software and platforms, including requirements for vulnerability management with critical and high-risk vulnerabilities to be mitigated within 30 days of patch release and medium-risk vulnerabilities within 60 days. Contractors must develop software using industry standards and secure programming techniques, maintain compatibility with County-supported operating systems, implement role-based access controls with least privilege access, enable default auditing for privileged access and changes, and ensure integration capability with Active Directory and County database systems. The contractor must also disclose all third-party software versions to be installed and provide ongoing support for critical and high-risk vulnerability updates. Additional requirements mandate that software support electronic delivery of digitally signed upgrades from the contractor or third-party licensor's website and maintain documentation of security controls and mitigation strategies.
View the file
Other files
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Version 3.1 (04/29/2024) Page 1 of 3
Enterprise Technology Services Security Requirements Exhibit – Low Risk
1. Definitions
1.1. Equipment means the hardware being provided by Contractor under the Agreement.
1.2. Software means software provided or licensed by Contractor pursuant to the Agreement, including software-as-a-service (“SaaS”) products.
1.3. Contractor Platform means the web-based platform on which Contractor provides any SaaS or hosting Services under the Agreement, including any system or other solution that stores, hosts, or transmits County data.
All other capitalized terms not expressly defined within this exhibit shall retain the meaning ascribed to such terms in the Agreement (and if not so defined, then the plain language meaning appropriate to the context in which it is used).
2. Software Installed in County’s Network
2.1. Software Installed in County’s Network. To the extent Contractor provides any Software to be installed in County’s network, Contractor must:
2.1.1. advise County of all versions of any third-party software (e.g., Java, Adobe Reader) to be installed and support updates for critical and high-risk vulnerabilities discovered in applicable third-party or open source software;
2.1.2. ensure that the Software is developed based on industry standards and best practices, including following secure programming techniques and incorporating security throughout the Software-development life cycle;
2.1.3. develop and maintain the Software to operate on County-supported and approved operating systems and firmware versions;
2.1.4. mitigate critical and high-risk vulnerabilities (as defined by Common Vulnerability and Exposures (CVE) scoring system) to the Software or Contractor platform within 30 days after patch release, and medium-risk vulnerabilities within 60 days after patch release, notifying County of proposed mitigation steps to be taken and timeline for resolution if Contractor is unable to apply a patch to remedy the vulnerability;
2.1.5. ensure the Software provides for role-based access controls and runs with least privilege access, enables auditing by default for any privileged access or changes, and supports electronic delivery of digitally signed upgrades from Contractor’s or the third-party licensor’s website;
2.1.6. ensure software connectivity to database systems can be configured to integrate with Active Directory (AD);
File details come from the government source that posted it. Updated .