19-RFP2009 - Part H - Exhibit L - Security Controls Contract Language - Final.pdf
PDF 114 KB Posted
- Solicitation number
- 2009
- Issued by
- Alexandria City, Virginia
About this file
This is a Security Controls Contract Language document issued by the City of Alexandria, Virginia in June 2018 as part of a Computer-Aided Dispatch/Automatic Vehicle Location (CAD/AVL) system replacement procurement for DASH (the customer). The document establishes mandatory security requirements and contractual obligations for vendors providing services that involve processing, storing, or transmitting City data. Key security specifications include network security measures such as firewalls and intrusion detection systems; application security conforming to OWASP Top Ten Project standards and CWE/SANS guidelines; data security aligned with industry standards and applicable laws; and restrictions on data storage to designated target servers only, with prohibitions on processing City data on portable devices unless encrypted as part of backup and recovery processes. The contract requires secure data transmission via HTTPS, SFTP, VPN tunnels, or equivalent mechanisms, and mandates encryption of backup data and personally identifiable information using minimum 128-bit symmetric or 2048-bit asymmetric key lengths.
The vendor must restrict data use solely to purposes enumerated in the agreement and prohibit distribution, repurposing, or sharing across other applications or vendors without written City authorization. Upon contract termination, vendors must erase and render all City data unrecoverable within 30 days or seven days of City request, whichever is sooner, and certify completion in writing. Encrypted backups may be retained for up to 60 days for point-in-time restoration before automatic deletion, with media sanitization performed according to NIST SP800-88 standards. Vendors must notify the City's Chief Information Officer and Chief Information Security Officer within 24 hours of any security breach involving personal information, provide incident details, assume responsibility for notifying affected individuals and regulators, and indemnify the City against related claims. The City retains audit rights with a minimum two weeks' notice, and vendors must provide access to facilities, personnel, and documentation or cooperate with the City's appointed audit firm. Vendors with certified SSAE 16 Type II reviews may substitute external audit results, though the City retains the right to request additional control testing. All contract terms reference applicable industry standards from the Center for Internet Security, PCI/DSS, NIST, FISMA, and ISO/IEC 27000-series.
View the file
Other files
Show all 25
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Page | 1
June 2018
Security Controls Contract Language
1. Network Security. Vendor agrees at all times to maintain network security that – at a minimum – includes:
network firewall provisioning, intrusion detection, and at least annual third-party vulnerability assessments.
Likewise, Vendor agrees to maintain network security that conforms to applicable, generally recognized industry standards (see “11. Industry Standards”) and best practices that Vendor then applies to its own network or the network provided to the Vendor by a third party.
2. Application Security. Vendor agrees to provide, maintain, and support its software and subsequent updates, upgrades, and bug fixes such that the software is, and remains secure from those vulnerabilities as described in:
a) The Open Web Application Security Project’s (OWASP) “Top Ten Project” https://www.owasp.org/index.php/Main_Page or
b) The CWE/SANS Top 25 Programming Errors - http://cwe.mitre.org/top25/ or
c) CWE/SANS TOP 25 Most Dangerous Software Errors - https://www.sans.org/top25-software-errors; or
d) Other generally recognized and comparable industry practices or standards.
3. Data Security. Vendor agrees to preserve the confidentiality, integrity and accessibility of City data with administrative, technical and physical measures that conform to applicable, generally recognized industry standards
(see “11. Industry Standards”), applicable state, federal and international law, and best practices that Vendor then applies to its own processing environment. Maintenance of a secure processing environment includes but is not limited to the timely application of patches, fixes and updates to operating systems and applications as provided by vendor or open source support.
4. Data Storage. Vendor agrees that any and all City data will be stored, processed, and maintained solely on designated target servers and that no City data at any time will be processed on or transferred to any portable or laptop computing device or any portable storage medium, unless that device or storage medium is in use as part of the Vendor's designated backup and recovery processes and encrypted in accordance with “6. Data Encryption.”
5. Data Transmission. Vendor agrees to provide a secure mechanism that will allow any and all electronic transmission or exchange of system and application data with the City and/or any other parties expressly designated by the City to take place via secure means (using HTTPS or SFTP, VPN tunnel or equivalent) and solely in accordance with “7. Data Re-Use.”
6. Data Encryption. Vendor agrees to store all City backup data as part of its designated backup and recovery processes in encrypted form, using a commercially supported encryption solution. Vendor further agrees that any and all City data defined as personally identifiable information under current legislation or regulations stored on any portable or laptop computing device or any portable storage medium be likewise encrypted. Encryption solutions will be deployed with no less than a 128-bit key for symmetric encryption and a 2048 (or larger) bit key length for asymmetric encryption.
7. Data Re-Use. Vendor agrees that any and all data exchanged shall be used expressly and solely for the purposes enumerated in the Current Agreement and this Addendum. Data shall not be distributed, repurposed or shared across other applications, environments, or business units of Vendor. Vendor further agrees that no City data of any kind shall be transmitted, exchanged or otherwise passed to other vendors or interested parties except on a case-by-case basis as specifically agreed to in writing by City of Alexandria.
8. End of Agreement Data Handling. Vendor agrees that upon termination of this Agreement it shall erase, destroy, and render unrecoverable all City data from Vendor server and backup servers and certify in writing that https://www.owasp.org/index.php/Main_Page http://cwe.mitre.org/top25/ https://www.sans.org/top25-software-errors
Page | 2 these actions have been completed within 30 days of the termination of this Agreement or within 7 days of the request of an agent of the City, whichever shall come first. Vendors keeps encrypted backups on backup media for a period of up to 60 days for the sake of its clients, to allow for point-in-time restore and automatically deletes all backups after a maximum 60-day period. At a minimum, a “Clear” media sanitization is to be performed according to the standards enumerated by the National Institute of Standards, Guidelines for Media Sanitization, SP800-88, Appendix A - see http://csrc.nist.gov/.
9. Security Breach Notification. Vendor agrees to comply with all applicable laws that require notification in the event of any breach or compromise of the security or confidentiality of personal information provided by the City of Alexandria or related to a City of Alexandria employee(s), or other City-affiliated person or entity that may be in the possession of the Vendor or located in Vendor’s servers (“Notification Event”) as follows:
a. Notify the City’s Chief Information Officer and/or Chief Information Security officer by telephone at
703.746.3060 and e-mail at techsupport@alexandriava.gov of such an event within 24 hours of discovery, and
b. Include the facts of the Notification event, including general description of the incident, date of discovery, dates of breach (if known), steps taken by Vendor to investigate and mitigate harm, contact information for person at
Vendor to contact with further questions, and list of affected individuals affiliated with the City, and
c. Assume responsibility for informing all such individuals and regulators in accordance with applicable law, and
d. Provide the City with copies of any proposed notifications for the City’s review, and
e. Indemnify, hold harmless and defend City and its officers, and employees from and against any claims, damages, or other harm related to such Notification Event.
10. Right to Audit. City of Alexandria or an appointed audit firm (Auditors) has the right to audit the Vendor and the Vendor’s sub-vendors or affiliates that provide a service for the processing, transport or storage of City of
Alexandria’s data. City of Alexandria will announce their intent to audit the Vendor by providing at a minimum two weeks (10 business days) notice to the Vendor. This notice will go to the Vendor that this contract is executed with. A scope document along with a request for deliverables will be provided at the time of notification of an audit. If the documentation requested cannot be removed from the Vendor’s premises, the Vendor will allow the
Auditors access to their site. Where necessary, the Vendor will provide a personal site guide for the Auditors while on site. The Vendor will provide a private accommodation on site for data analysis and meetings; the accommodation will allow for a reasonable workspace, with appropriate lighting, electrical, a printer and Internet connectivity. The Vendor will make necessary employees or contractors available for interviews in person or on the phone during the timeframe of the audit. In lieu of the City or its appointed audit firm performing their own audit, if the Vendor has an external audit firm that performs a certified SSAE 16 Type II review, City of Alexandria has the right to review the controls tested as well as the results, and has the right to request additional controls to be added to the certified SSAE 16 Type II review for testing the controls that have an impact on City data. Audits will be at City of Alexandria's sole expense. If the audit reveals material noncompliance with contract specifications, the vendor will bear the expense of remedying the noncompliance.
11. Industry Standards. Generally recognized industry standards include but are not limited to the current standards and benchmarks set forth and maintained by the:
a. Center for Internet Security - see http://www.cisecurity.org
b. Payment Card Industry/Data Security Standards (PCI/DSS) - see http://www.pcisecuritystandards.org/
c. National Institute for Standards and Technology - see http://csrc.nist.gov
d. Federal Information Security Management Act (FISMA) - see http://csrc.nist.gov
e. ISO/IEC 27000-series - see http://www.iso27001security.com/
f. Organization for the Advancement of Structured Information Standards (OASIS) - see mailto:techsupport@alexandriava.gov http://www.pcisecuritystandards.org/
Page | 3 http://www.oasis-open.org/
12. Vendor Warranty. Vendor (i) warrants that the services provided in this agreement will be in substantial conformity with IT security assessment documentation, IT security control and configuration documentation provided by Vendor: and (ii) agrees to inform the City promptly of any material variation in operations from that reflected in the above documentation; and (iii) agrees to inform the City of any material deficiency in operations from those as described.
City of Alexandria
Vendor Name
Printed Name
Printed Name
Title
Title
Signature Signature
Date
Date
File details come from the government source that posted it. Updated .