10-HC Minimum IT Security Vendor Controls List.pdf

This is a Minimum IT Security Vendor Controls List document prepared for Harris County, Texas, establishing security requirements and vendor control standards applicable to information technology service providers and system vendors. The document outlines mandatory security controls and vendor compliance requirements that must be met by any vendor providing services or systems to Harris County, including those responding to the Financial Reporting System RFP for the Harris County Auditor's Office. The controls list establishes baseline security standards across multiple domains such as access control, encryption, incident response, data protection, and vendor management to ensure that all IT systems and services meet the county's information security governance framework.

The vendor controls list serves as a critical compliance document that vendors must acknowledge and adhere to when contracting with Harris County. Vendors responding to the Auditor's Office Financial Reporting System opportunity must demonstrate their ability to implement and maintain the security controls specified in this document throughout the contract term. This requirement applies to all hardware, software, and services delivered under the contract and represents Harris County's standard expectation for IT security across all county departments and vendor relationships. Non-compliance with the specified controls may result in contract termination or remediation requirements, and vendors must be prepared to provide evidence of control implementation during both pre-award evaluation and ongoing contract performance.