2-ICS Vendor Policy - Signature Line.pdf

VENDOR POLICY FOR SOFTWARE SYSTEMS

VERSION 2021.08.26

INFORMATION AND COMMUNICATION SERVICES

AUGUST 26, 2021

Chatham County Vendor Policy for So�ware Systems 1

REVISION AND EVENT HISTORY

Ref# Version Date Author Descrip�on

1 2019.11.1 11/19/2019 ICS

2 2021.03.08 3/08/2021 Nick Batey Updated to include addi�onal terms

3 2021.08.26 8/26/2021 Andrew Cree Finalized for distribu�on

DEFINITIONS

vendor – any company providing so�ware products and/or services to any Chatham County agency.

vendor solu�on – any technology solu�on provided by a vendor and in use, or under considera�on for use, at any Chatham County agency.

system – all related technology in the context of the vendor solu�on, or the use of the vendor solu�on within any agency of Chatham County.

ICS – the Informa�on and Communica�on Services department of Chatham County, responsible for all informa�on technology func�ons throughout the County government.

third party components – any component required in the minimum system requirements of the vendor solu�on which is not manufactured and/or controlled by the vendor. These may include plugins, libraries, so�ware, drivers, scripts, dongles, or other similar types of components.

Usable format – a data export which provides all records within the related database(s), and all informa�on necessary to fully represent and relate data components of each record. The preferred format for this data is a CSV file with one record per line, all data columns present with full descrip�ons for each column header and, where applicable, what each value in each data element represents.

INTRODUCTION

These policies are intended to inform vendors of our expecta�ons and obtain agreement from vendors to meet those expecta�ons. A demonstra�on on how the proposed solu�on will meet each of the controls listed here must be performed for the County IT Department during the proposal process.

CHATHAM COUNTY INFORMATION TECHNOLOGY VENDOR POLICY

All vendors providing or proposing a vendor solu�on to Chatham County must adhere to the following requirements:

1. Chatham County owns all data rela�ve to Chatham County, or any subpart thereof, the vendor solu�on, including, but not limited to, data entered or stored in the system, metadata, and all deriva�ve data generated by any means.

1.1. Chatham County data will not be used for sale, and cannot be sold, by either aggregated data collec�on or any other variant, without explicit approval of a Chatham County authorized official.

2. All data must be exported and returned to Chatham County upon termina�on of contract and within 72 hours, allowing Chatham County to con�nue opera�ons.

Chatham County Vendor Policy for So�ware Systems 2

2.1. The format for this data return must be nego�ated and agreed to at the �me of contract signing. In the absence of an agreed format, a full database extrac�on rou�ne/script must be provided, which produces data in a usable format, along with all accesses and permissions for data extrac�on.

2.2. Data cannot be withheld from Chatham County for any reason.

2.3. Data return, with all condi�ons in this document met, will be free of charge to Chatham County.

3. Only the Chatham County Informa�on and Communica�ons Services (ICS) Director, the County Manager, or designee are authorized regarding the copying, replica�ng, and modifying of data, outside of normal opera�ons of vendor solu�on, unless granted through explicit writen permission, per instance.

4. The Contract is between the County and the Vendor, not the employee who is assigned to use the service.

Contract modifica�ons must be conducted only by specified personnel and in wri�ng. No “Click-Wrap Agreements”, “On-Screen”, or other user agreements are enforceable under this contract.

5. User management must be accomplished through the exis�ng centralized user management u�lized throughout the County for authen�ca�on, authoriza�on, and all access permissions. Specifically, at the �me of this wri�ng, either Ac�ve Directory, Azure Ac�ve Directory, or a compa�ble broker service will be required.

6. ICS must approve and supervise/log all modifica�ons to produc�on systems, including, but not limited to, log files.

7. Provisions must exist which provide Chatham County con�nued use of the so�ware or hardware in the event the vendor or manufacturer should cease opera�ons. This includes access to the produc�on data or solu�on source code.

8. The vendor solu�on must provide all necessary components to use the proposed system on the end user PC, including, but not limited to, an automated packaged installa�on method, minimum requirements, and third-party so�ware.

9. The vendor must provide documented industry best prac�ces for using the vendor solu�on and demonstrate how these best prac�ces are being followed, both opera�onal and security related.

10. Chatham County prohibits the use of end-of-life components and the vendor solution must operate on ICS supported platforms.

10.1. In the event third party components are u�lized, the System so�ware provided by vendor must con�nually use current, supported components and the support for those components fully covered by the vendor’s support agreement.

10.2. Vendor must provide an inventory of so�ware used to install and support vendor solu�on. ICS must approve all support so�ware.

11. Vendor must get ICS approval for remote access so�ware and/or hardware to access any Chatham County equipment.

Chatham County Vendor Policy for So�ware Systems 3

12. Vendor Solu�on must operate within Chatham County’s current environment with minimal configura�on outside of the vendor’s solu�on.

13. If any credit card transac�ons will be facilitated, in any way, the system must be PCI Compliant and the vendor must provide a PCI DSS cer�ficate upon request.

13.1. Vendor must provide a complete Service Level Agreement in the proposal, and as part of the final contract, outlining the service levels for up�me, system response �me, data backup restore, and customer and technical support.

14. Outsourcing

14.1. The cloud vendor is directly responsible for all terms of the contract, regardless of outsourced func�ons.

14.2. The vendor must inform the County of any outsourced func�onality and its provider.

14.3. No assignment of the contract or components of the contract can occur without explicit, writen agreement from the County.

14.4. All legal or regulatory requirements that apply to the County data must be supplied by the Vendor. (Example HIPAA)

15. The Chatham County IT Director may consider excep�ons on a case-by-case basis.

ITEMS SPECIFIC TO ON-PREMISE SOLUTIONS

The following items are specific to solu�ons deployed on Chatham County infrastructure

1. The vendor must request remote access to on-premise systems in advance and be limited to only the systems related to the environment of the vendor solution.

2. Core func�ons of the vendor solu�on must operate without internet access or remote services. Absence of this, the vendor solu�on will be considered “Hybrid” and the condi�ons of the SAAS solu�ons will also apply.

3. The vendor must document, in detail, all func�onality requiring remote access, remote services, or other external dependencies.

4. Vendor solu�on must func�on within reasonable security controls, in alignment with NIST standards and associated security models, including, but not limited to, industry standard firewalls.

5. All infrastructure is the property of Chatham County.

ITEMS SPECIFIC TO SOFTWARE AS A SERVICE (SAAS) SOLUTIONS

The following items are specific to solu�ons deployed on vendor hosted infrastructure

Chatham County Vendor Policy for So�ware Systems 4

1. Communication between the Chatham County network and remote server(s) must be encrypted using current industry standards, in alignment with NIST standards and associated security models. This functionality must be either provided by the vendor or the vendor must comply with and support the methodologies employed by the ICS.

2. Vendor must have established security practices, standards, and regular audits. Chatham County must be provided a copy of this information at least once a year.

3. Data backup must be facilitated

3.1. Vendor will provide backups, including documentation for backup and retention schedules for all data.

3.2. If backups are not provided by vendor, a means for Chatham County to perform backups will be provided as part of the vendor solution.

4. All Chatham County data, or derivatives of, will remain within the continental United States and will not be replicated, stored, or otherwise located, in any way, in a foreign nation. Further, all data will be fully segregated from another customer’s data.

5. Data storage and servers must be CJIS compliant.

6. Vendor must be able to limit user accesses to only ICS approved sources, such as an IP address or network.

7. The County must be able to access and retrieve its data stored in the cloud at its sole discretion.

8. Disaster recovery procedures need to be clearly outlined and related timelines established, from the point of disaster declaration, to restoring full system operation.

9. The vendor must coordinate with Chatham County to plan and schedule downtime at least 48 hours in advance. Any other instances will be considered emergency maintenance and a full report of the incident must be submitted to ICS within 48 hours of occurrence.

Vendor Acknowledgment: ____________________________ Signature Date