2026HCA4-ExhibitF-DataSecurityQuestionnaire.xlsx

Instructions

Passing a Security Design Review with the Office of Cyber Security is a requirement before any sharing of HCA data. The purpose of the Security Questionnaire is to set expectations with the Bidder about the level of detail and effort needed to complete the Security Design Review and for HCA to assess the security posture of the ASB.

Requirements Bidder: The contents captured within this document are exempt from disclosure per RCW 42.56.420(4) https://app.leg.wa.gov/RCW/default.aspx?cite=42.56.420

Agencies are responsible for ensuring that vendor solutions have adequate physical security and environmental protections implemented to maintain the confidentiality, integrity, and availability of the vendor computer systems. Vendors must prevent unauthorized access, damage, or compromise of IT assets. Investments in physical and environmental security must be commensurate with the risks, threats, and vulnerabilities unique to each physical site and location.

3 - Facilities Vendors must develop, document, and implement policies and procedures for the following:

Data security components outlined in this section are designed to reduce the risk associated with the unauthorized access, disclosure, or destruction of agency data.

4.1 - Data Classification Agencies must classify data stored in vendor systems into categories based on the sensitivity of the data.

Agency data classifications must translate to or include the following classification categories:

Public information is information that can be or currently is released to the public. It does not need protection from unauthorized disclosure, but does need integrity and availability protection controls.

(2) Category 2 - Sensitive Information Sensitive information may not be specifically protected from disclosure by law and is for official use only. Sensitive information is generally not released to the public unless specifically requested.

(3) Category 3 - Confidential Information Confidential information is information that is specifically protected from either release or disclosure by law. This includes, but is not limited to:

a.) Personal information as defined in RCW 42.56.590 and RCW 19.255.10.

b.) Information about public employees as defined in RCW 52.56.250.

c.) Lists of individuals for commercial purposes as defined in RCW 42.56.070 d.) Information about the infrastructure and security of computer and telecommunication networks as defined in RCW 42.56.420.

(4) Category 4 - Confidential Information Requiring Special Handling Confidential information requiring special handling is information that is specifically protected from disclosure by law and for which:

a.) Especially strict handling requirements are dictated, such as by statutes, regulations, or agreements; or b.) Serious consequences could arise from unauthorized disclosure, such as threats to health and safety, or legal sanctions.

4.2 - Data Sharing Agencies must ensure that sharing data with the public at large complies with the OCIO Public Records Privacy Protection Policy and other applicable statutes or regulations.

When sharing Category 3 and above data outside the agency, an agreement must be in place unless otherwise prescribed by law. The agreement (such as a contract, a service level agreement, or a dedicated data sharing agreement) must address the following:

DO NOT RESPOND, HCA TO COMPLETE

Vendors must use approved standards to protect category 3 and category 4 and may use these standards for category 1 and 2 data as described in the Data Classification Standard.

4.3.2 - Workstations Vendors must:

Vendors must use NIST FIPS approved encryption for the confidentiality and integrity of data at rest and data in transit:

** This does not include the distribution of a one-time use PIN, password, passphrase, token code, etc., provided it is not distributed along with any other authentication information**

4.3.4 - Data must be encrypted at rest.

Vendors must:

Vendors must use approved encryption algorithms for category 3 and category 4 data in addition to consideration for special handling requirements:

Symmetric encryption: FIPS 197 - Advanced Encryption Standard (AES) validated Advanced Encryption Standard (AES) (≥ 128- bit).

Vendors must:

Appropriately protect information transmitted electronically. The transmission of category 3 and 4 data requires encryption such that:

i. All manipulations or transmissions of data during the exchange are secure.

ii. If intercepted by unauthorized parties during transmission the data cannot be deciphered.

iii. When necessary, confirmation is received when the intended recipient receives the data.

Appropriate encryption methods for data in transit include, but are not limited to:

i. Transport Layer Security (TLS) 1.2 or later version.

ii. Secure Shell (SSH) 2.0 or later version.

Vendors must:

Agencies are responsible for ensuring the secure vendor operation of network assets through the use of appropriate layered protections commensurate with the risk and complexity of the environment.

5.1 - Secure Segmentation Vendors must:

(1) Define and implement logical boundaries to segment networks as determined by system risk and data classification.

(2) Enforce controls to protect segments and individual assets within each segment.

The methods to achieve secure segmentation include but are not limited to those detailed in Sections 5.1.1 - 5.1.3.

5.1.1 - Network Devices Vendors must:

a. Authentication of routing protocols.

b. Ingress filtering at network edge locations.

c. Internal route filtering.

d. Routing protocols are enabled only on necessary interfaces.

e. Restrict routing updates on access ports.

f. Secure or disable physical network connections in public areas.

5.1.2 - Firewalls Vendors must:

All items must be true in order for "yes" to be accurate

a. Allow system administration only through secure encrypted protocols.

b. Prevent access by unauthorized source IP addresses or subnets.

c. Block ingress of internal addresses from an external interface into the DMZ or internal interface.

d. Block services, protocols, and ports not specifically allowed.

e. Allow only necessary egress communications from the internal network to the DMZ, Internet and wireless networks.

f. Allow only necessary ingress communications to the internal network from the DMZ, Internet and wireless networks.

g. Maintain comprehensive audit trails.

h. Fail in a closed state if failure occurs.

i. Operate boundary/perimeter firewalls on a platform specifically dedicated to firewalls.

Vendors must:

Vendors must implement controls to prohibit the use of the following service and application types listed in this section unless specifically authorized. The use of restricted services must be documented in the vendor IT security program and approved by management. Restricted services include but are not limited to:

Agencies with devices connected to the SGN must:

DO NOT RESPOND, HCA TO COMPLETE

Vendors are responsible for the secure deployment of wireless networks. Vendors must ensure:

NOTE: If wireless networks are prohibited, the vendor IT Security Program documentation must define how this is periodically verified and enforced.

(1) The vendor IT Security Program addresses the use of wireless technologies including but not limited to:

a. 802.11

b. Bluetooth

(2) Wireless devices that extend their Local Area Networks (LANs):

a. Securely segment wireless access point connections from the vendor network.

b. Use WPA or its successor for authentication and encryption. Use WPA2 Enterprise on all new equipment purchased and existing equipment that supports the protocol.

c. Change wireless vendor defaults including but not limited to pre-shared keys and passwords.

d. Disable Simple Network Management Protocol (SNMP) unless there is a clear business need. If enabled, change the vendor defaults.

e. Follow wireless access security practices developed within the vendor.

f. Continuously monitor for rogue wireless devices.

(3) Wireless devices that do not extend the vendor's local area network:

All items must be true in order for "yes" to be accurate

a. Securely segment wireless access point connections from the Internet.

b. Use authentication and encryption appropriate for the environment.

c. Change wireless vendor defaults including but not limited to pre-shared keys and passwords.

d. Disable Simple Network Management Protocol (SNMP) unless there is a clear business need. If enabled, change the vendor defaults.

e. Follow wireless access security practices developed within the vendor.

f. Monitor for rogue wireless devices as defined in the vendor security program.

(4) Open or public access wireless environments do not share assets or traverse infrastructure components that connect to the vendor network unless wireless traffic is securely segmented, encapsulated or tunneled over shared infrastructure.

5.5 - Security Patch Management Vendors must develop and document in the vendor IT Security Program a patch management process commensurate with the risk and complexity of the IT environment that at a minimum includes:

Vendors must:

Vendors must:

DO NOT RESPOND, HCA TO COMPLETE

5.8 - Mobile Computing Examples of mobile devices include laptops, smart phones, Personal Digital Assistants (PDAs), accessible equipment, and portable data storage devices such as tape drives, zip drives, removable hard drives, and USB data storage devices.

Vendors must implement policies and procedures controlling the use of Category 3 and above data on mobile devices. At a minimum, Vendors must:

To ensure proper access controls that conform to the principle of least privilege agencies must:

To ensure appropriate management of user accounts on system components vendors must:

To ensure appropriate management of sessions on system components vendors must:

To ensure system controls are effectively enforcing access policies vendors must:

Vendors must ensure:

All items must be true in order for "yes" to be accurate

a. Be a minimum of 10 characters long and contain at least three of the following character classes: uppercase letters, lowercase letters, numerals, special characters.

b. Not contain the user's name, UserID or any form of their full name.

c. Not consist of a single complete dictionary word, but can include a passphrase.

d. Be significantly different from the previous four passwords. Passwords that increment (Password1, Password2, Password3 ...) are not considered significantly different.

(5) Passwords used for Internal Authentication Types outlined under section 6.3.2 must:

All items must be true in order for "yes" to be accurate

a. Be a minimum of 8 characters long and contain at least three of the following character classes: uppercase letters, lowercase letters, numerals, special characters.

b. Not contain the user's name, UserID or any form of their full name.

c. Not consist of a single complete dictionary word, but can include a passphrase.

d. Be significantly different from the previous four passwords. Passwords that increment (Password1, Password2, Password3 ...) are not considered significantly different.

(6) PIN codes used in multi-factor authentication schemes must:

All items must be true in order for "yes" to be accurate

a. Be a minimum of five digits in length.

b. Not be comprised of all the same digit. PINs consisting of 11111, 22222 are not acceptable.

c. Not contain more than a three consecutive digit run. PINs consisting of 12347, 98761 are not acceptable.

(7) Pass codes used to secure mobile devices must:

All items must be true in order for "yes" to be accurate

a. Be a minimum of six alpha numeric characters.

b. Contain at least three unique character classes. Pass codes consisting of 11111a, aaaaa4, are not acceptable.

c. Not contain more than a three consecutive character run. Pass codes consisting of 12345a, abcde1 are not acceptable.

d. Render the device unusable after 10 failed login attempts.

6.3 - Authentication Authentication is used to validate the identity of users performing functions on systems. Selecting the appropriate authentication method is based on risks to data.

Access to category 1 data, if authenticated, requires authentication via the SecureAccess® Washington infrastructure (OCIO Identity Management User Authentication Standards 7/10/2008) with the following controls:

(1) Requires UserID and hardened passwords as defined in Section 6.2.

(2) Password expiration not to exceed 24 months.

(3) Successful authentication requires that the individual prove through a secure authentication protocol (in other words, encrypted) that the individual controls the password.

(4) Category 1 data may be accessed using type 2 or 3 authentication.

6.3.1.2 - Type 2 (External) Access to category 2 data or a single category 3 record belonging to the individual requires authentication via the SecureAccess® Washington infrastructure (OCIO Identity Management User Authentication Standards 7/10/2008) with the following controls:

(1) Requires UserID and hardened passwords as defined in Section 6.2.

(2) Password expiration period not to exceed 24 months.

(3) Successful authentication requires that the individual prove through a secure authentication protocol (in other words, encrypted) that the individual controls the password.

6.3.1.3 - Type 3 (External) Access to category 3 data or a single category 4 record belonging to the individual requires multi-factor authentication via the SecureAccess® Washington infrastructure (IOCIO Identity Management User Authentication Standards 7/10/2008) with the following controls:

(1) Requires multi-factor authentication supported by SecureAccess® Washington.

(2) Passwords must meet the criteria outlined in Section 6.2.

(3) Password expiration period not to exceed 13 months.

(4) Requires that the individual prove through a secure authentication protocol (in other words, encrypted) that the individual controls the password or token.

(5) Category 3 data may be accessed using type 4 authentication.

6.3.1.4 - Type 4 (External) Access to category 4 information requires multi-factor authentication via the SecureAccess® Washington or Transact Washington infrastructure (OCIO Identity Management User Authentication Standards 7/10/2008) with the following controls:

(1) Requires multi-factor authentication using hardware or software tokens or digital certificates.

(2) Requires that the individual prove through a secure, encrypted authentication protocol that the individual controls the token by first unlocking the token with a password, PIN or biometric in a secure authentication protocol to establish two factors of authentication using a hardware or software token or digital certificate.

6.3.1.5 - Type 5 (External) Employee and contractor access to agency/vendor resources or the SGN via common remote access methods outlined in Section 6.4 requires two-factor authentication with the following controls:

(1) Requires that the individual prove through a secure, encrypted authentication protocol that the individual controls a hardware or software token by first unlocking the token with a password, PIN or biometric in a secure authentication protocol to establish two factors of authentication.

6.3.1.6 - Type 6 (External) Authenticated access that does not meet the criteria outlined in the OCIO Identity Management User Authentication Standards, 7/10/2008, requires, at a minimum, the use of the same controls specified in Authentication Types 1,2 and 3 above, as determined by the category of data.

Access to category 4 data and below requires authentication via the Enterprise Active Directory infrastructure (OCIO Identity Management User Authentication Standards, 7/10/2008) with the following controls:

(1) Requires UserID and hardened passwords as defined in Section 6.2.

(2) Password expiration period not to exceed 120 days.

6.3.2.2 - Type 8 (Internal) Access to system administration functions requires the following controls:

(1) Requires a discrete account used only for interactive system administration functions.

(2) Where passwords are employed as an authentication factor:

a. Requires a hardened password as defined in Section 6.2 with an extended password length of 16 characters.

b. Password expiration period not to exceed 60 days.

6.3.2.3 - Type 9 (Internal) Accounts used for system service, daemon or application execution (service accounts) require documentation in the agency security program and the following controls:

(1) Requires a discrete account used only for the defined privileged functions, and never used by an individual.

(2) Requires a hardened password as defined in Section 6.2 with an extended password length of 20 characters.

(3) Password expiration requirements must be documented in the agency security program.

(4) The principle of least privilege must be employed when determining access requirements for the account.

6.3.2.4 - Type 10 (Internal) Authenticated access that does not meet the criteria outlined in the OCIO Identity Management User Authentication Standards, 7/10/2008, requires the following minimum controls:

(1) Requires a hardened password as defined in Section 6.2 or stronger authentication.

(2) Password expiration not to exceed 120 days.

(3) Additional controls documented in the agency IT Security Program.

6.4 - Remote Access Vendor must:

(1) Implement policies and procedures for remote access that mitigate the threat or risk posed by users or devices authorized to connect remotely to the vendor network including but not limited to:

a. Monitoring practices for remote access sessions.

b. Requirements for remote access devices.

c. Remote access session controls that conform to the principle of least privilege.

7.1 - Planning and Analysis Vendors must specify security controls when developing business requirements for new or enhanced information systems including but not limited to:

Vendors must develop software applications based on industry best practices and include information security throughout the software development life cycle, including the following:

Vendors must:

Vendors must prevent common coding vulnerabilities in software development processes. Vendors must:

(1) Develop software and applications based on secure coding guidelines. An example is the Open Web Application Security Project guidelines. See www.owasp.org - "The Ten Most Critical Web Application Security Vulnerabilities" which include:

a. Un-validated input.

b. Weak or broken access control such as malicious use of UserIDs.

c. Broken authentication/session management such as use of account credentials and session cookies.

d. Cross-site scripting (XSS) attacks.

e. Buffer overflows.

f. Injection flaws such as SQL injection.

g. Improper error handling that creates other conditions, divulges system architecture or configuration information.

h. Insecure storage.

i. Denial of service.

j. Insecure configuration management.

8.1 - Change Management Vendors must implement an effective change management process that:

Vendors must:

Vendors must:

a. Sanitize equipment containing storage media prior to disposal, consistent with NIST SP 800-88 Guidelines for Media Sanitation.

b. Destroy, securely overwrite, or make unavailable all data and software consistent with the software licensing agreement.

c. Verify the media is fully sanitized.

d. Verify the sanitization tools are tested and maintained per a documented schedule.

e. Maintain records that provide the date and methods used to sanitize and/or dispose of the storage media, and include attestation of the process by at least one individual.

f. Physically destroy media when it cannot be sanitized through the use of software tools. Agencies may choose to physically destroy media even when the software sanitization tools are effective. Physical destruction may be accomplished by shredding, pulverization or other means that ensure the media can never be re-used. Disposal of physically destroyed media should be conducted in accordance with the Responsible Recycling (R2) standard, the e-Stewards Standard, or some other environmentally responsible way.

Vendors must:

Agencies are responsible for ensuring that vendors address the effect of using the Internet to conduct transactions for state business with other public entities, citizens, and businesses.

Audit logs recording user activities, exceptions, and information security events are necessary to detect and audit unauthorized information processing activities.

10.1 - Logging and Policies Vendors must develop and document a logging strategy that addresses each system based on the risk and complexity of the system. At a minimum the logging strategy must address the following:

At a minimum, logging systems must satisfy the logging strategy identified by the agency and:

All items must be true in order for "yes" to be accurate

a. Actions taken by individuals with root or administrative privileges.

b. Invalid logical access attempts.

c. Initialization of the logging process.

d. Creation and deletion of system objects.

11 - Incident Response Vendors must:

NOTE: In the event of an incident involving the release of Category 3 data and above, agencies must work with vendors to comply, as appropriate, with the state breach notification statute, RCW 42.56.590.

All items must be true in order for "yes" to be accurate

a. Escalation procedures.

b. Designate specific personnel to respond to alerts.

c. Be prepared to implement the incident response plan and to respond immediately to a system breach.

d. Provide appropriate training to staff with security breach response responsibilities.

e. Have a process to modify and evolve the incident response plan according to lessons learned and to incorporate industry developments.

f. Incorporate the incident response plan in the agency IT Security Program.

Example Responses

Access to category 3 data or a single category 4 record belonging to the individual requires multi-factor authentication via the SecureAccess® Washington infrastructure (IOCIO Identity Management User Authentication Standards 7/10/2008) with the following controls:

(1) Requires multi-factor authentication supported by SecureAccess® Washington.

(2) Passwords must meet the criteria outlined in Section 6.2.

(3) Password expiration period not to exceed 13 months.

(4) Requires that the individual prove through a secure authentication protocol (in other words, encrypted) that the individual controls the password or token.

(5) Category 3 data may be accessed using type 4 authentication.

Access to category 4 data and below requires authentication via the Enterprise Active Directory infrastructure (OCIO Identity Management User Authentication Standards, 7/10/2008) with the following controls:

(1) Requires UserID and hardened passwords as defined in Section 6.2.

(2) Password expiration period not to exceed 120 days.

Agencies are responsible for ensuring that vendors address the effect of using the Internet to conduct transactions for state business with other public entities, citizens, and businesses.

User Types