14-Enterprise Technology Services Security Requirements Exhibit – Low Risk.pdf

Version 3.1 (04/29/2024) Page 1 of 3

Enterprise Technology Services Security Requirements Exhibit – Low Risk

1. Definitions

1.1. Equipment means the hardware being provided by Contractor under the Agreement.

1.2. Software means software provided or licensed by Contractor pursuant to the Agreement, including software-as-a-service (“SaaS”) products.

1.3. Contractor Platform means the web-based platform on which Contractor provides any SaaS or hosting Services under the Agreement, including any system or other solution that stores, hosts, or transmits County data.

All other capitalized terms not expressly defined within this exhibit shall retain the meaning ascribed to such terms in the Agreement (and if not so defined, then the plain language meaning appropriate to the context in which it is used).

2. Software Installed in County’s Network

2.1. Software Installed in County’s Network. To the extent Contractor provides any Software to be installed in County’s network, Contractor must:

2.1.1. advise County of all versions of any third-party software (e.g., Java, Adobe Reader) to be installed and support updates for critical and high-risk vulnerabilities discovered in applicable third-party or open source software;

2.1.2. ensure that the Software is developed based on industry standards and best practices, including following secure programming techniques and incorporating security throughout the Software-development life cycle;

2.1.3. develop and maintain the Software to operate on County-supported and approved operating systems and firmware versions;

2.1.4. mitigate critical and high-risk vulnerabilities (as defined by Common Vulnerability and Exposures (CVE) scoring system) to the Software or Contractor platform within 30 days after patch release, and medium-risk vulnerabilities within 60 days after patch release, notifying County of proposed mitigation steps to be taken and timeline for resolution if Contractor is unable to apply a patch to remedy the vulnerability;

2.1.5. ensure the Software provides for role-based access controls and runs with least privilege access, enables auditing by default for any privileged access or changes, and supports electronic delivery of digitally signed upgrades from Contractor’s or the third-party licensor’s website;

2.1.6. ensure software connectivity to database systems can be configured to integrate with Active Directory (AD);

Version 3.1 (04/29/2024) Page 2 of 3

2.1.7. ensure the Software is not within three (3) years from its end-of-life date and provide County with end-of-life-schedules for all applicable Software;

2.1.8. support encryption using at a minimum Advanced Encryption Standard 256-bit encryption keys (“AES-256”) or current industry security standards, whichever is higher, for County Confidential Data at rest and use transport layer security (TLS) 1.2 or current industry standards, whichever is higher, for data in motion; and

2.1.9. upon request by County, provide an attestation letter identifying date of the most recent security vulnerability testing performed and any vulnerabilities identified and mitigated (must be dated within six (6) months after any major release).

3. Equipment Leased or Purchased from Contractor

3.1. Equipment Leased or Purchased from Contractor. To the extent Contractor is the Original Equipment Manufacturer (OEM) or an authorized reseller for the OEM for any Equipment provided under this Agreement, Contractor must:

3.1.1. ensure that physical security features to prevent tampering are included in any Equipment provided to County and ensure, at a minimum, industry-standard security measures are followed during the manufacture of the Equipment;

3.1.2. ensure any Equipment provided does not contain any embedded remote-control features unless approved in writing by County’s Contract Administrator, and disclose any default accounts or backdoors that exist for access to County’s network;

3.1.3. shall supply a patch, firmware update, or workaround approved in writing by County’s Contract Administrator within thirty (30) days after identification of a new critical or high risk vulnerability, and within sixty (60) days after identification of a medium risk vulnerability and notify County of proposed mitigation steps taken;

3.1.4. develop and maintain Equipment to interface with County-supported and approved operating systems and firmware versions;

3.1.5. upon request by County, make available any required certifications as may be applicable per compliance and regulatory requirements (e.g., Common Criteria, Federal Information Processing Standard 140);

3.1.6. ensure the Equipment is not within three (3) years from its end-of-life date at the time of delivery and provide County with end-of-life-schedules for all applicable Equipment;

3.1.7. (for OEMs only) support electronic delivery of digitally signed upgrades of any applicable Equipment firmware from Contractor’s or the OEM’s website; and

Version 3.1 (04/29/2024) Page 3 of 3

3.1.8. (for OEMs only) upon request by County, provide an attestation letter identifying date of the most recent security vulnerability testing performed and any vulnerabilities identified and mitigated (must be dated within six (6) months after any major release).

4. SaaS or Hosting Service

SaaS or Hosting Services. To the extent Contractor provides SaaS or web hosting services, all Software, SaaS, and all Hosted Services or other web-based solution provided or made available as part of the Services must comply with the County’s Service Provider Secure Coding Standard, including as may be updated from time to time by County upon written notice to Contractor.

For any web-based solution provided or made available as part of the Services that hosts County data, Contractor will ensure that County can authenticate County employee user accounts by username/password and Multi-Factor Authentication or SSO with County Active Directory Federated Services. Any SaaS provider or website hosting County data must account for confidentiality, integrity, and availability to the extent required by County security standards, and Contractor must immediately notify County of any information security breach or unauthorized access or modification of County data. Contractor shall maintain the same standards set forth herein for its data centers and other facilities that store or host County data.

4. SaaS or Hosting Service