210000000301.pdf

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Independent Cyber Assessment Services for Local Entities Pre-qual

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

January 25, 2021 January 24, 2026 5 - 1 Year January 10, 2026

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

300 S. Washington Sq. Suite 200

Lansing MI 48933

Joe Findlater

517-881-4973 jfindlater@dewpoint.com

CV0040100

DEWPOINT INC

C O

N

TR

A C

TO

R

Emily Massa

517-897-7321

DTMB

Various Various massae@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

N/ANet 45

Change Notice Number 9

Contract Number MA210000000301 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

0 Years

$3,296,695.99 $3,296,695.99

DESCRIPTION

Effective September 8th, 2025, $215,769.00 is added to this contract to support the attached scope of work for The Department of Great Lakes and Energy.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement approval.

AGENCY NAME PHONE EMAIL

MDHHS PRATIN TRIVEDI 517-334-6560 TrivediP@michigan.gov

DTMB Stephanie Jeppesen 517-335-6899 jeppesens@michigan.gov

Program Managers for

Multi-Agency and Statewide Contracts

CHANGE NOTICE NO. 9 TO CONTRACT NO. MA210000000301

CHANGE NOTICE NO. 9 TO CONTRACT NO. MA210000000301

CN 9 – EGLE DRINKING WATER

Dewpoint will conduct a comprehensive security maturity assessment for Department of Environment, Great Lakes, and Energy (EGLE) using the Center for Internet Security (CIS) Critical Security Controls Version 8 framework. The assessment will focus on Implementation Group 1 (IG1) controls and safeguards, providing EGLE with a clear understanding of its stakeholders current security posture and actionable recommendations for improvement.

Dewpoint will utilize its on-premises instance of the CIS CSAT V8.0 platform to ensure consistency and efficiency throughout the assessment. The CSAT portal (https://csat.cisecurity.org/) will serve as the central platform for data entry, scoring, and reporting. Dewpoint will tailor the organizational structure within CSAT to align with EGLE’s internal structure, ensuring relevance and long-term tracking capabilities.

1. Data Collection

To evaluate EGLE stakeholders current security controls, Dewpoint will collect and analyze the following:

i. Completion of a Pre-Assessment Questionnaire to establish baseline posture

ii. Review of EGLE’s IT security policies, processes, and procedures

iii. Analysis of supporting documentation and data

iv. Interviews with key stakeholders identified by EGLE

v. Review of prior IT security assessment recommendations, if applicable

Dewpoint will coordinate with EGLE and stakeholders:

i. Pre-scheduling interviews and meetings

ii. Preparing agendas and reviewing documentation in advance

iii. Applying proven communication strategies from past engagements

2. Assessment

Dewpoint will execute the assessment using a four-phased approach:

1. Planning & Scheduling (in coordination with EGLE)

a. Assign dates to tasks and deliverables

b. Establish communication protocols

2. Data Gathering & Interviews

a. Conduct stakeholder interviews

b. Collect and review documentation

3. Assessment & Scoring

a. Input data into CSAT

b. Score each safeguard using CIS maturity scale

4. Reporting & Recommendations

a. Generate executive-level summary report

b. Provide detailed findings and remediation guidance

3. Evaluation Criteria Each CIS control will be scored based on maturity using the following scale:

Maturity Level Description

Needs Improvement 0-50%

The current implementation for the control area is very limited and immature. Sub controls lack implementation on systems as well as lack policies and reporting mechanisms. Immediate action should be evaluated to improve maturity for this control and may require significant resource,capital investment, or both.

Fair 51-75%

The current implementation for the control is at an average level of maturity. Controls have been implemented on some or most systems but may still lack overarching policies and procedures. A moderate level of change is required to continue to elevate maturity for the control.

Satisfactory 76-90%

Current control implementation meets accepted standards in the industry. There are documented policies and procedures, but they may lack formal adoption and reporting.

Excellent 91-100%

Current control implementation is in near or complete compliance with standards in the industry. There are documented policies, procedures, and reporting mechanisms in place.

4. Deliverables Dewpoint will provide the following:

i. Executive Summary Report: Visual snapshot of utilities current posture vs. target maturity, utilities should remain anonymous and be identified by category (such as small, medium and large)

ii. Detailed Findings Report (for utility):

a. Breakdown by control and safeguard

b. Control requirements and environmental context

c. Importance and risk of each control

d. Specific findings and tailored recommendations

e. Maturity rating and remediation guidance

5. Timeline & Project Management

i. Dewpoint’s project manager will coordinate all activities, assign dates, and manage the schedule in collaboration with EGLE.

ii. Regular check-ins and updates will be provided to EGLE stakeholders

iii. Dewpoint will ensure accountability and transparency throughout the engagement

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

DTMB

320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Independent Cyber Assessment Services for Local Entities Pre-qual

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

January 25, 2021 January 24, 2026 5 - 12 Months January 10, 2026

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

300 S. Washington Sq. Suite 200

Lansing MI 48933

Joe Findlater

517-881-4973 jfindlater@dewpoint.com

CV0040100

DEWPOINT INC

C O

N

TR

A C

TO

R

Emily Massa

517-897-7321

DTMB

Various Various massae@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

N/ANet 45

Change Notice Number 8

Contract Number MA210000000301 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$3,296,695.99 $0.00 $3,296,695.99

DESCRIPTION

Starting 4/24/2026, throughout the Term, all websites, applications, software, content, and electronic documents, including but not limited to mobile applications, text, images, sounds, videos, controls, animations, links, and documents (including files in the following formats: PDF, word processing, presentation, and spreadsheet), created, provided, or made available by the Contractor under this Contract, must comply with WCAG 2.1 Level AA.

DTMB Stephanie Jeppesen 517-335-6899 jeppesens@michigan.gov

Program Managers for

Multi-Agency and Statewide Contracts

CHANGE NOTICE NO. 8 TO CONTRACT NO. MA210000000301

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Independent Cyber Assessment Services for Local Entities Pre-qual

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

January 25, 2021 January 24, 2026 5 - 12 Months January 10, 2026

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

300 S. Washington Sq. Suite 200

Lansing MI 48933

Joe Findlater

517-881-4973 jfindlater@dewpoint.com

CV0040100

DEWPOINT INC

C O

N

TR

A C

TO

R

Melissa Beck

517-897-1502

DTMB

Various Various

Beckm3@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

N/ANet 45

Change Notice Number 7

Contract Number MA210000000301 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

December 31, 2027

$1,812,947.00 $1,483,748.99 $3,296,695.99

DESCRIPTION

Effective November 19, 2024, this contract is increased by $1,483,749.00 for IT security assessments and vulnerability scans as identified in the statement of work by the Office of Child Support.

All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement, DTMB Central Procurement approval, and State Administrative Board approval on 11/19/2024.

DTMB Stephanie Jeppesen 517-335-6899 JeppesenS@michigan.gov

Program Managers for

CHANGE NOTICE NO. 7 TO CONTRACT NO. MA210000000301

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Independent Cyber Assessment Services for Local Entities Pre-qual

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

January 25, 2021 January 24, 2026 5 - 12 Months January 10, 2026

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

300 S. Washington Sq. Suite 200

Lansing MI 48933

Joe Findlater

517-881-4973 jfindlater@dewpoint.com

CV0040100

Dewpoint, Inc.

C O

N

TR

A C

TO

R

Melissa Beck

517-896-1502

DTMB

Various Various beckm3@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

N/A

Change Notice Number 6

Contract Number MA210000000301 to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$1,812,947.00 $0.00 $1,812,947.00

DESCRIPTION

Effective August 13, 2024, the Contract administrator has been changed to Melissa Beck:

Melissa Beck beckm3@michigan.gov

517-896-1502

DTMB Stephanie Jeppesen 517-335-5899 JeppesenS@michigan.gov

DTMB Derek Larson 517-241-6606 LarsonD4@Michigan.gov

DTMB Stephanie Jeppesen 517-335-6899 jeppesens@michigan.gov

DTMB Stephanie Jeppesen 517-335-6899 jeppesens@michigan.gov

DTMB Jayson Cavendish 517-243-8692 CavendishJ@michigan.gov

DTMB Stephanie Jeppesen 517-335-6899 JeppesenS@michigan.gov

DTMB Stephanie Jeppesen 517-335-6899 jeppesenS@Michigan.gov

DTMB Stephanie Jeppesen 517-335-6899 JeppesenS@Michigan.gov

MDHHS PRATIN TRIVEDI 517-334-6560 TrivediP@michigan.gov

DTMB Stephanie Jeppesen 517-335-6899 JeppesenS@michigan.gov

Program Managers for

CHANGE NOTICE NO. 6 TO CONTRACT NO. MA210000000301

CENTRAL PROCUREMENT SERVICES

Department of Technology, Management, and Budget

320 S. WALNUT ST., LANSING, MICHIGAN 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 5 to

Contract Number 210000000301

Various

Jordana Sager jfindlater@dewpoint.com

Joe Findlater

Lansing, MI 48933

Dewpoint, Inc.

CV0040100

517-881-4973

300 S. Washington Sq. Suite 200

(517) 896-1903

S T

A T

E

P ro g ra m

M a n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

DTMB

sagerj2@michigan.gov

$1,812,947.00

January 25, 2021 January 10, 2026

INDEPENDENT CYBER ASSESSMENT SERVICES FOR LOCAL ENTITIES PRE-QUAL

January 24, 2026

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

NET 45

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☒ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ N/A

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

N/A

$0.00 $1,812,947.00

Effective July 13, 2023, please note the State's Program Manager has been changed from Jayson Cavendish to Stephanie Jeppesen.

Stephanie Jeppesen 7150 Harris Drive Dimondale MI 48821 JeppesenS@michigan.gov 517-335-6899

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement approval.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

N/A

DESCRIPTION

CONTRACT SUMMARY

MULTI

Program Managers for

CHANGE NOTICE NO. 5 TO CONTRACT NO. 210000000301

PRATIN TRIVEDI 517-334-6560 TrivediP@michigan.govMDHHS

Stephanie Jeppesen 517-335-6899 JeppesenS@michigan.govDTMB

Department of Technology, Management, and Budget

320 S. WALNUT ST., LANSING, MICHIGAN 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 4 to

Contract Number

210000000301 - REVISED

Various

Jordana Sager jfindlater@dewpoint.com

Joe Findlater

Lansing, MI 48933

Dewpoint, Inc.

CV0040100

517-881.4973

300 S. Washington Sq. Suite 200

(517) 896-1903 S

T A

T E

P ro g n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

DTMB

sagerj2@michigan.gov

$1,812,947.00

January 25, 2021 January 10, 2026

INDEPENDENT CYBER ASSESSMENT SERVICES FOR LOCAL ENTITIES

January 24, 2026

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

NET 45

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☒ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ N/A

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

N/A

$0.00 $1,812,947.00

Effective February 21, 2023, the following contacts have been changed:

Vendor Primary Contact: Joe Findlater 517.881.4973 jfindlater@dewpoint.com

Vendor Program Manager: Noelle Rose nrose@dewpoint.com

State's Program Manager: Pratin Trivedi (PM on the SOW added with CN 2) 517-334-6560 TrivediP@michigan.gov

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

N/A

DESCRIPTION

DTMB

Contract Admin: Jordana Sager sagerj2@michigan.gov 517-896-1903

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement approval.

Program Managers for

CHANGE NOTICE NO. 4 TO CONTRACT NO. 210000000301

Jayson Cavendish 517-241-1624 CavendishJ@Michigan.govDTMB

PRATIN TRIVEDI 517-334-6560 TrivediP@michigan.govMDHHS

Department of Technology, Management, and Budget

320 S. WALNUT ST., LANSING, MICHIGAN 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 4 to

210000000301Contract Number

Various

Jordana Sager jfindlater@dewpoint.com

Joe Findlater

Lansing, MI 48933

Dewpoint, Inc.

CV0040100

517-881.4973

300 S. Washington Sq. Suite 200

(517) 896-1903 S

T A

T E

P ro g n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

DTMB

sagerj2@michigan.gov

$1,812,947.00

January 25, 2021 January 10, 2026

INDEPENDENT CYBER ASSESSMENT SERVICES FOR LOCAL ENTITIES

January 24, 2026

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

NET 45

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☒ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ N/A

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

N/A

$0.00 $1,812,947.00

Effective February 21, 2023, the following contacts have been changed:

Vendor Primary Contact: Joe Findlater 517.881.4973 jfindlater@dewpoint.com

Vendor Program Manager: Noelle Rose nrose@dewpoint.com

State's Program Manager: Jason Rodgers 517-303-3806 RodgersJ1@michigan.gov

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

N/A

DESCRIPTION

Contract Admin: Jordana Sager sagerj2@michigan.gov 517-896-1903

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement approval.

Program Managers for

CHANGE NOTICE NO. 4 TO CONTRACT NO. 210000000301

Jason Rodgers 517-303-3806 RodgersJ1@michigan.govDTMB

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 3 to

210000000301Contract Number

Various

Courtney Powell kschafka@dewpoint.com

Kelly Schafka

Lansing, MI 48933

Dewpoint, Inc.

CV0040100

517-230-1519

300 S. Washington Sq. Suite 200

(517) 249-0452 S

T A

T E

P ro g n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

DTMB

powellc11@michigan.gov

$1.00

January 25, 2021 January 10, 2026

INDEPENDENT CYBER ASSESSMENT SERVICES FOR LOCAL ENTITIES

January 24, 2026

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

NET 45

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☒ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ January 10, 2026

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

N/A

$1,812,946.00 $1,812,947.00

Effective Janyary 4, 2022 this contract is increased by $1,812,946.00 for work associated with CN 2. The attached Invoice and Payment Schedule is also being added to the contract.

All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement, DTMB Central Procurement approval, and State Administrative Board approval on 1/4/2022.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

N/A

DESCRIPTION

Program Managers for

CHANGE NOTICE NO. 3 TO CONTRACT NO. 210000000301

Mark Shook 313-600-1515 shookm1@michigan.govDTMB

Dewpoint, Inc. - IT Audit Contract

Invoice and Payment Schedule

Month End FY 22 FY 23 FY 24 FY25

October $104,250 $21,000 $25,829

November $104,250 $21,000 $25,829

December $104,250 $21,000 $25,829

January $104,250 $21,000 $25,829

February $104,250 $21,000 $25,829

March $104,250 $21,000 $25,829

April $104,250 $21,000 $25,829

May $104,250 $21,000 $25,829

June $104,250 $21,000 $25,829

July $104,250 $21,000 $25,829

August $104,250 $21,000 $25,829

September $104,250 $21,000 $25,829

Total by State FY $938,250 $501,750 $295,460 $77,487 $1,812,946

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

Change Notice Number 2 to

210000000301Contract Number

Various

Courtney Powell kschafka@dewpoint.com

Kelly Schafka

Lansing, MI 48933

Dewpoint, Inc.

CV0040100

517-230-1519

300 S. Washington Sq. Suite 200

(517) 249-0452 S

T A

T E

P ro g n a g e r

C o n tra ct

A d m in istra to r

C O

N T R A C T O

R

DTMB

powellc11@michigan.gov

$1.00

January 25, 2021 January 10, 2026

INDEPENDENT CYBER ASSESSMENT SERVICES FOR LOCAL ENTITIES

January 24, 2026

INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

5 - 1 Year

PAYMENT TERMS DELIVERY TIMEFRAME

Net 45

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

☐ P-Card ☐ PRC ☐ Other ☒ Yes ☐ No

MINIMUM DELIVERY REQUIREMENTS

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION REVISED EXP. DATE

☐ ☐ January 10, 2026

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

N/A

$0.00 $1.00

Effective December 7, 2021 the following Schedule A - SOW and associated attachments are added to this Contract for use by DHHS. The State PM on this project is Mark Shook.

The Contractor's Contract Administrator has changed to Kelly Schafka (kschafka@dewpoint.com, 517-230-1519).

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement approval.

INITIAL EXPIRATION DATEINITIAL EFFECTIVE DATE

N/A

DESCRIPTION

MULTI

Program Managers for

CHANGE NOTICE NO. 2 TO CONTRACT NO. 210000000301

Mark Shook 313-600-1515 shookm1@michigan.govDTMB

210000002458 1

SCHEDULE A – STATEMENT OF WORK

CONTRACT ACTIVITIES

CN 2 - 210000002458

Cybersecurity Assessment and Advisory Services for “County Managed” Friend of Court and Prosecuting Attorney Offices in Michigan

BACKGROUND

Background on Certification Requirement and 2019 assessment cycle

• Michigan Office of Child Support (OCS) is required by the federal Office of Child Support Enforcement (OCSE) to certify the safeguard and security of Title IV-D child support confidential data including Federal Parent Locator Service data as attested to in the Annual Security Agreement between OCSE and OCS. Every three years, an independent security assessment is to be conducted involving child support program information and the computer systems storing and processing that information.

• To complete this requirement in 2019, OCS required county managed Friend of the Court (FOC) and Prosecuting Attorney (PA) offices to conduct an independent third-party assessment of compliance with the OCSE Security Agreement. Counties were reimbursed 66 percent of the incurred costs to meet this requirement.

• OCS received the third-party audit results and corrective action plans or Plan of Action and Milestones (POAM), when necessary, from the county-managed agencies.

SCOPE

OCS, in partnership with DTMB Agency Services (AS) and Michigan Cyber Security (MCS), will engage a pre-qualified Contractor from the Michigan Cyber Partners MiDEAL Independent Cyber Assessment and Advisory Services contract to assess each county managed office’s technical security controls that are required to maintain OCS' OCSE Annual Security Certification over a 3-year period.

1. Requirements OCS, in partnership with DTMB and Michigan Cyber Security will coordinate Contractor acquisition through the Michigan Cyber Partners MiDEAL independent cyber assessment and advisory service contract to assess the information technology (IT) environment and controls at each of the county managed offices that impacts the safeguard of Title IV-D child support data. More about Michigan Cyber Partners at www.michgan.gov/cyberpartners.

OCS is seeking one (1) Contractor (or a prime with sub- contractors) to provide services outlined and required for this project who will provide:

• Consistent county level reports on the findings of their county managed IT systems and environment.

• Comprehensive statewide summary report.

http://www.michgan.gov/cyberpartners

210000002458 2

• Remediation advisory services through the remainder of the contract period.

All county assessments and initial reporting MUST be completed by September 30, 2022. Statewide summary report must be completed by November 30, 2022.

Monitoring and remediation advisory services are to be provided through the remainder of the contract period.

The Center for Internet Security (CIS) Controls are to be used for the county assessment and reporting. OCS has identified specific CIS controls and subcontrols that map to the OCSE security certification requirements.

Work closely with county FOC, PA, and IT staff to ensure a smooth process that focuses on assessing, reporting on, and improving the information security processes of individual offices and the statewide system by identifying risks and monitoring remediation with follow up reporting on remediation activities to OCS.

1.1. Individual County Assessments

Conduct individual assessments for each county managed FOC and PA office – see Attachment A - Michigan County Offices for list of counties and locations.

Assessment will follow MiDEAL contract specifications including Core Service Offering Deliverables and Optional Services as detailed below.

A. Core Service Offering Deliverables

1. On-site or virtual cybersecurity assessment jointly completed by an independent assessor and local entity staff using the CIS Controls Self- Assessment Tool (CSAT).

2. Current-state report (based on CSAT) the overall assessment results including most important vulnerabilities and recommended next steps for remediation.

3. Annual Cybersecurity Improvement Plan (POAM) that identifies priority actions to complete in the coming 12 months and other lesser priority activities that have a longer time horizon.

4. Ensure that county has an effective basic cyber incident response plan. A sample incident response plan is on the Cyber Partners website:

www.michigan.gov/cyberpartners.

5. Monthly one-hour telephone/online or in-person consultation to provide ongoing coaching and consulting regarding understanding of and implementation of cybersecurity improvements for each county assessed.

6. End of contract assessment update using CSAT which identifies progress made towards improving priority items identified in initial assessment and items remaining to be addressed.

B. MiDEAL Optional Deliverables - REQUIRED for this engagement as part of each county/office assessment MiDEAL Optional Deliverable #2: Assessment and planning for CIS Controls/Sub Controls in Implementation Groups (IG) 2 and 3.

1. Requirement: Assess each county office using IG 1 controls as identified in Core Services Offerings #1 and additional controls in IG 2 and 3 http://www.michigan.gov/cyberpartners

210000002458 3 identified in Attachment B - Controls Required for OCS County Level Assessments.

MiDEAL Optional Deliverable #4 Conduct Penetration Test

2. Requirement: Penetration testing including internal vulnerability scanning -based on Internal Revenue Service (IRS) SCSEM and County IT Infrastructure Architecture. Include these findings and remediation steps in overall assessment results and Annual Cybersecurity Improvement Plan and coaching activities. The IRS Safeguards links can be found at the following IRS sites:

a. https://www.irs.gov/privacy-disclosure/computer-security-compliance-references-and-related-topics

b. https://www.irs.gov/privacy-disclosure/nessus-audit-files

MiDEAL Optional Deliverable #3: Assistance with audits or compliance requirements that are present at the local entity based on business practices.

(CJIS, PCI, HIPAA, IRS-1075, FERPA, etc…)

3. Requirement: County assessment results, improvement plans, and planning documents and activities must include all CIS subcontrols identified in Attachment B and results of Penetration Testing and Plan of Action and Milestones (POAM).

1.2. Statewide Reporting of Assessment Results

The reporting requirements described below are listed as Deliverables 1, 2, and 3 under B. Optional Service Offerings in the MiDEAL contracts are required under this SOW:

• #1 – General Advisory Services on a time and materials basis.

• #2 – Assessment and planning for CIS Controls/SubControls in

Implementation Groups 2 and 3.

• #3 – Assistance with audits or compliance requirements that are present at the local entity based on business practices. (CJIS, PCI, HIPAA, IRS- 1075, FERPA, etc…)

A. Requirement: Statewide summary of county-by-county results for both CIS Controls and Penetration Testing identifying counties in high, medium, and low risk categories and number of outstanding findings. POAMs are to be updated twice per year in years 2 and 3 (see section 1.3 Schedule of Deliverables, below).

B. Requirement: Statewide summary of results that will create a common understanding of the state of child support data related to cybersecurity at county managed offices and anonymized results that can be used to inform policy at county, State of Michigan, and OCS levels.

C. Requirement: Project Management, planning, and project reporting including scheduling of assessments and regular updates.

The Contractor will manage this program under the guidance of OCS and DTMB using an industry standard Program/Project Management methodology.

https://www.irs.gov/privacy-disclosure/computer-security-compliance-references-and-related-topics https://www.irs.gov/privacy-disclosure/computer-security-compliance-references-and-related-topics https://www.irs.gov/privacy-disclosure/nessus-audit-files

210000002458 4

1. The Contractor will conduct a Program Kickoff with the OCS and DTMB concerning the overall program and state-wide project plan. Additionally, the vendor will conduct kick-off meetings with each county that will be assessed to outline the individual assessment.

2. The Contractor will present the state-wide Project Management Plan (PMP) to the OCS and DTMB within 10 business days of the program start date. The Contractor will use the State Unified Information Technology Environment (SUITE) PMM 102 Template (see Attachment D - Project Management Plan PMM-0102) to document the PMP.

3. Contractor will adhere to the standard Communication and Change Management processes outlined in the PMP.

4. Quarterly progress reports must be submitted to the OCS and DTMB Project Managers throughout the life of this contract. This report may be submitted with the billing invoice. Each Quarterly progress report must contain the following:

a. Overall Program status using the Green/Yellow/Red format including percentage complete, any risks, and issues.

b. Accomplishments: Indicate what was worked on and what was completed during the current reporting period.

c. Next steps and/or activities that are expected to be completed in the next reporting period

1.3. Schedule of Deliverables:

This contract is for assessment, remediation oversight, and coaching only.

Selected Contractor is expected to assist with remediation support but is precluded from selling additional products or services related to this contract to counties during the life of this agreement. Contract deliverables must be completed within three (3) years or not later than October 1, 2024.

2. Service Requirements

2.1. Timeframes

All Contract Activities must be delivered within the timeframe set forth in section 1.3 above and must be completed by October 1, 2024. The receipt of order date is pursuant to the Notices section of the Standard Contract Terms.

3. Acceptance Acceptance will be in accordance with section 16. Acceptance in the Standard Contract Terms.

4. Staffing

/1

/2

1/ 1/

4/ 1/

7/ 1/

/1

/2

1/ 1/

4/ 1/

7/ 1/

/1

/2

1/ 1/

4/ 1/

7/ 1/

/1

/2

Contract Period Begins Initial County Assessments and County Reports County Submitted POAM 30 days after assessment report Project Management Reporting to OCS Statewide Report to OCS Remediation Support/Coaching/Monitoring Starts after county reports are completed Annual Remediation Assessment Update 1 year from POAM submission

210000002458 5

4.1. Contractor Representative

The Contractor must appoint an Account Executive/Engagement Manager, Cybersecurity Expert and Technical Testing Lead individuals specifically assigned to State of Michigan accounts, who will respond to State inquiries regarding the Contract Activities, answer questions related to ordering and delivery, etc. (the “Contractor Representative”). Refer to Attachment C for qualifications and forms.

4.2. Work Hours

The Contractor must provide Contract Activities during the State’s normal working hours outlined on the main contract.

4.3. Key Personnel

The Contractor must appoint a Project Manager, an Account Executive/Engagement Manager and Cybersecurity Expert individuals who will be directly responsible for the day-to-day operations of the Contract (“Key Personnel”). Key Personnel must be specifically assigned to the State account, be knowledgeable on the contractual requirements, and respond to State inquiries within 24 hours.

The State has the right to recommend and approve in writing the initial assignment, as well as any proposed reassignment or replacement, of any Key Personnel. Before assigning an individual to any Key Personnel position, Contractor will notify the State of the proposed assignment, introduce the individual to the State’s Project Manager, and provide the State with a resume and any other information about the individual reasonably requested by the State. The State reserves the right to interview the individual before granting written approval. In the event the State finds a proposed individual unacceptable, the State will provide a written explanation including reasonable detail outlining the reasons for the rejection. The State may require a 30-calendar day training period for replacement personnel.

Contractor will not remove any Key Personnel from their assigned roles on this Contract without the prior written consent of the State. The Contractor’s removal of Key Personnel without the prior written consent of the State is an unauthorized removal (“Unauthorized Removal”). An Unauthorized Removal does not include replacing Key Personnel for reasons beyond the reasonable control of Contractor, including illness, disability, leave of absence, personal emergency circumstances, resignation, or for cause termination of the Key Personnel’s employment. Any Unauthorized Removal may be considered by the State to be a material breach of this Contract, in respect of which the State may elect to terminate this Contract for cause under the Termination for Cause section of the Standard Contract Terms. It is further acknowledged that an Unauthorized Removal will interfere with the timely and proper completion of this Contract, to the loss and damage of the State, and that it would be impracticable and extremely difficult to fix the actual damage sustained by the State as a result of any Unauthorized Removal. Therefore, Contractor and the State agree that in the case of any Unauthorized Removal in respect of which the State does not elect to exercise its rights under Termination for Cause, Contractor will issue to the State the corresponding credits set forth below (each, an “Unauthorized Removal Credit”):

i. For the Unauthorized Removal of any Key Personnel designated in the applicable

Statement of Work, the credit amount will be $25,000.00 per individual if Contractor identifies a replacement approved by the State and assigns the replacement to shadow the Key Personnel who is leaving for a period of at least 30-calendar days before the Key Personnel’s removal.

210000002458 6

ii. If Contractor fails to assign a replacement to shadow the removed Key Personnel for at least 30-calendar days, in addition to the $25,000.00 credit specified above, Contractor will credit the State $833.33per calendar day for each day of the 30-calendar day shadow period that the replacement Key Personnel does not shadow the removed Key Personnel, up to $25,000.00maximum per individual. The total Unauthorized Removal Credits that may be assessed per Unauthorized Removal and failure to provide 30-calendar days of shadowing will not exceed $50,000.00per individual.

Contractor acknowledges and agrees that each of the Unauthorized Removal Credits assessed above: (i) is a reasonable estimate of and compensation for the anticipated or actual harm to the State that may arise from the Unauthorized Removal, which would be impossible or very difficult to accurately estimate; and (ii) may, at the State’s option, be credited or set off against any fees or other charges payable to Contractor under this Contract.

The Contractor must identify the Key Personnel, indicate where they will be physically located, describe the functions they will perform, and provide current chronological résumés.

4.4. Organizational Chart

The Contractor must provide an overall organizational chart that details staff members, by name and title, and subcontractors.

4.5. Disclosure of Subcontractors

If the Contractor intends to utilize subcontractors, the Contractor must disclose the following:

• The legal business name; address; telephone number; a description of subcontractor’s organization and the services it will provide; and information concerning subcontractor’s ability to provide the Contract Activities.

• The relationship of the subcontractor to the Contractor.

• Whether the Contractor has a previous working experience with the subcontractor. If yes, provide the details of that previous relationship.

• A complete description of the Contract Activities that will be performed or provided by the subcontractor.

5. Project Management

5.1. Project Plan

Per the original pre-qualification contracts, within 10 business day of the award of this SOW, the Contractor must submit, for final approval, a detailed project plan to the Contracting Entity.

The final Project Plan must be in agreement with the Contractor’s SOW proposal and accepted by the State. Detailed requirements will include steps required to plan and conduct onsite assessment, deliver draft and final assessment reports and plan and schedule monthly check in meetings; and individuals responsible for receiving/reacting to the requested information, including names and titles of personnel assigned to the project, both from the Contractor and State.

The Contractor will carry out this project under the direction and control of the State Program Manager. Within 45 calendar days of the Effective Date, the Contractor must submit a mutually agreed upon project plan to the Program Manager for approval. The

210000002458 7 plan must include: (a) the Contractor's organizational chart with names and title of personnel assigned to the project, which must align with the staffing stated in accepted proposals; and (b) the project breakdown showing sub-projects, tasks, timeline, and resources required.

5.2. Meetings

The Contractor must attend the Kick-off meeting within five (5) business days of the Effective Date.

Ongoing update meetings will be mutually agreed upon.

The State may request other meetings, as it deems appropriate.

5.3. Reporting

The Contractor must submit, to the Program Manager or designee, periodic (weekly or bi-weekly) and ongoing status and progress reports.

6. Invoice and Payment

6.1. Invoice Requirements

All invoices submitted to the State must include: (a) date; (b) purchase order; (c) quantity; (d) description of the Contract Activities; (e) unit price; (f) shipping cost (if any);

(g) vendor-generated invoice number; and (h) total price. Overtime, holiday pay, and travel expenses will not be paid.

6.2. Payment Methods

The State will make payment for Contract Activities via EFT.

7. Liquidated Damages Late or improper completion of the Contract Activities will cause loss and damage to the State and it would be impracticable and extremely difficult to fix the actual damage sustained by the State. Therefore, if there is late or improper completion of the Contract Activities the State is entitled to collect liquidated damages in the amount of $10,000 and an additional $1,000 per day for each day Contractor fails to remedy the late or improper completion of the Work.

Schedule B - Pricing for 3 Years Small Entity Medium Entity Large Entity X-Large Entity

>50 End Points

50-500 End Points

500-1500 End Points

1500+ End Points

Fixed Price for MIDEAL Core Services:

1. Cybersecurity Assessment Workshop using CIS Controls and CSAT Tool

2. Assessment Report & Recommendations

3. Cybersecurity Improvements Plan

4. Baseline Incident Response Plan

5. Monthly Advisory Sessions (1 hour)

6. End of Engagement Assessment

7,681.00$ 13,216.00$ 15,600.00$ 20,762.00$

Number of Entities 11 23 16 8 Total 84,491$ 303,968$ 249,600$ 166,096$ 804,155$

Small Entity Medium Entity Large Entity X-Large Entity >50 End Points

50-500 End Points

500-1500 End Points

1500+ End Points

County Level: Fixed Price Fixed Price Fixed Price Fixed Price Additional 8 CIS Controls in IG 2 and 3 from Attachment B 1,092.00$ 1,877.00$ 2,216.00$ 2,936.00$

Penetration Test 4,268.00$ 5,978.00$ 9,750.00$ 13,164.00$ Subtotal 5,360.00$ 7,855.00$ 11,966.00$ 16,100.00$ Number of Entities 11 23 16 8 Total 58,960$ 180,665$ 191,456$ 128,800$ 559,881$

Statewide Reporting:

County by County Summary 58,000$ Statewide Summary of Results 24,860$ Project Management 366,050$ Total 448,910$ 448,910$

Grand Total 1,812,946$

Additional Cost Considerations Anything else to offer to the State or miscelaneous cost values here.

Monthly coaching beyond initial 12 months

MIDEAL Core Services

Required Optional Service Offerings from Schedule B in MIDEAL Contract

ATTACHMENT A - MICHIGAN COUNTY OFFICES

List of County Offices to be reviewed

County County

Population

Child Support System Users

(Approx.)

Prosecuting Attorney

Friend of the Court

Combined Circuit with

Alcona County 10,364 26 x Allegan County 115,250 31 x x Alpena County 28,612 17 x Antrim County 23,177 38 x x Barry County 60,057 35 x x Bay County 104,786 41 x x Benzie County 17,552 22 x x Berrien County 154,807 75 x x Branch County 43,584 18 x x Calhoun County 134,473 83 x x Cass County 51,460 23 x x Cheboygan County 25,458 31 x x Clare County 30,616 8 x x Clinton County 77,896 38 x x Eaton County 109,155 37 x x Emmet County 33,039 27 x x Genesee County 409,361 125 x x Gladwin County 25,289 27 x x

Grand Traverse County 91,746 39 x Antrim FOC & Leelanau FOC

Gratiot County 41,067 24 x x Ingham County 289,564 106 x x Ionia County 64,176 33 x Iosco County 25,247 41 x x Isabella County 70,775 25 x x Jackson County 158,913 72 x x Kalamazoo County 261,573 88 x x Kalkaska County 17,463 24 x x Kent County 643,140 152 x x Lapeer County 88,202 31 x x Leelanau County 21,639 35 x x Lenawee County 98,474 32 x Livingston County 188,482 45 x x Macomb County 868,704 147 x x Manistee County 24,444 25 x x Benzie FOC Marquette County 66,939 33 x x Mason County 28,884 13 x x Menominee County 23,234 20 x x Midland County 83,389 49 x x Monroe County 149,699 52 x x Montcalm County 63,209 33 x x Muskegon County 173,043 109 x x

County Office

Montmorency FOC

Newaygo County 48,142 28 x x Oakland County 1,250,843 236 x x Oceana County 26,417 18 x Oscoda County 8,277 30 x x Otsego County 24,397 37 x x Ottawa County 284,034 77 x x Presque Isle County 12,797 21 x Roscommon County 23,877 18 x x Saginaw County 192,778 55 x x Sanilac County 41,376 21 x Shiawassee County 68,493 30 x x St. Clair County 159,566 71 x x St. Joseph County 60,897 37 x x Tuscola County 53,250 21 x x Van Buren County 75,272 36 x x Washtenaw County 365,961 90 x x Wayne County 1,761,382 435 x x

3191 54 54

Note: Counties with a combined circuit may have more than one county IT network to review and assess.

CIS Controls v8 CIS Safeguards Asset Type Title Description IG 1 IG 2 IG 3 OCSE IG1 and/or OCS

1 1.1 Devices

Establish and Maintain Detailed Enterprise Asset

Inventory

Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data, to include: end-user devices (including portable and mobile), network devices, non-computing/IoT devices, and servers. Ensure the inventory records the network address (if static), hardware address, machine name, enterprise asset owner, department for each asset, and whether the asset has been approved to connect to the network. For mobile end-user devices,MDM type tools can support this process, where appropriate. This inventory includes assetsconnected to the infrastructure physically, virtually, remotely, and those within cloud environments.

Additionally, it includes assets that are regularly connected to the enterprise's network infrastructure, even if they are not under control of the enterprise. Review and update the inventory of all enterprise assets bi-annually, or more frequently. 1 1 1 1 1

2 1.2 Devices Address Unauthorized Assets

Ensure that a process exists to address unauthorized assets on a weekly basis. The enterprise may choose to remove the asset from the network, deny the asset from connecting remotely to the network, or quarantine the asset. 1 1 1 1

6 2.1 Applications Establish and Maintain a Software Inventory

Establish and maintain a detailed inventory of all licensed software installed on enterprise assets. The software inventory must document the title, publisher, initial install/use date, and business purpose for each entry; where appropriate, include the Uniform Resource Locator (URL), app store(s), version(s), deployment mechanism, and decommission date. Review and update the software inventory bi-annually, or more frequently. 1 1 1 1

7 2.2 Applications

Ensure Authorized Software is Currently

Supported

Ensure that only currently supported software is designated as authorized in the software inventory for enterprise assets.

If software is unsupported, yet necessary for the fulfillment of the enterprise's mission, document an exception detailing mitigating controls and residual risk acceptance. For any unsupported software without an exception documentation, designate as unauthorized. Review the software list to verify software support at least monthly, or more frequently. 1 1 1 1

Summary:

Controls Required for OCS County Level Assessments

56 Safeguards/Subcontrols from Controls V8 plus 8 controls added from OCSE requirements

Attachment B - Controls Required for OCS County Level Assessment

8 2.3 Applications Address Unauthorized Software

Ensure that unauthorized software is either removed from use on enterprise assets or receives a documented exception.

Review monthly, or more frequently. 1 1 1 1

13 3.1 Data

Establish and Maintain a Data Management

Process

Establish and maintain a data management process. In the process, address data sensitivity, data owner, handling of data, data retention limits, and disposal requirements, based on sensitivity and retention standards for the enterprise.

Review and update documentation annually, or when significant enterprise changes occur that could impact this

Safeguard. 1 1 1 1 1

14 3.2 Data Establish and Maintain a Data Inventory

Establish and maintain a data inventory, based on the enterprise's data management process. Inventory sensitive data, at a minimum. Review and update inventory annually, at a minimum, with a priority on sensitive data. 1 1 1 1

15 3.3 Data Configure Data Access Control Lists

Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications. 1 1 1 1 1

16 3.4 Data Enforce Data Retention

Retain data according to the enterprise's data management process. Data retention must include both minimum and maximum timelines. 1 1 1 1

17 3.5 Data Securely Dispose of Data

Securely dispose of data as outlined in the enterprise's data management process. Ensure the disposal process and method are commensurate with the data sensitivity. 1 1 1 1 1

18 3.6 Devices Encrypt Data on End-User Devices

Encrypt data on end-user devices containing sensitive data.

Example implementations can include: Windows BitLocker, Apple FileVault, Linux dm-crypt. 1 1 1 1 1

22 3.1 Data Encrypt Sensitive Data in Transit

Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure

Shell (OpenSSH). 1 1 1 1

23 3.11 Data Encrypt Sensitive Data at Rest

Encrypt sensitive data at rest on servers, applications, and databases containing sensitive data. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data. 1 1 1 1

26 3.14 Data Log Sensitive Data Access Log sensitive data access, including modification and disposal. 1 1 1

27 4.1 Applications

Establish and Maintain a Secure Configuration

Process

Establish and maintain a secure configuration process for enterprise assets (end-user devices, including portable and mobile; non-computing/IoT devices; and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard. 1 1 1 1 1

28 4.2 Network

Establish and Maintain a Secure Configuration

Process for Network Infrastructure

Establish and maintain a secure configuration process for network devices. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard. 1 1 1 1

29 4.3 Users

Configure Automatic Session Locking on Enterprise

Assets

Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose operating systems, the period must not exceed 15 minutes.

For mobile end-user devices, the period must not exceed 2 minutes. 1 1 1 1 1

30 4.4 Devices Implement and Manage a Firewall on Servers

Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent. 1 1 1 1

31 4.5 Devices

Implement and Manage a Firewall on End-User

Devices

Implement and manage a host-based firewall or port-filtering tool on end-user devices, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed. 1 1 1 1

32 4.6 Network Securely Manage Enterprise Assets and Software

Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled-infrastructure-as-code and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure

(HTTPS). Do not use insecure management protocols, such as

Telnet (Teletype Network) and HTTP, unless operationally essential. 1 1 1 1

33 4.7 Users

Manage Default Accounts on Enterprise Assets and Software

Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable. 1 1 1 1

39 5.1 Users Establish and Maintain an Inventory of Accounts

Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must include both user and administrator accounts. The inventory, at a minimum, should contain the person's name, username, start/stop dates, and department. Validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently. 1 1 1 1 1

40 5.2 Users Use Unique Passwords

Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA. 1 1 1 1

41 5.3 Users Disable Dormant Accounts

Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported. 1 1 1 1

42 5.4 Users

Restrict Administrator Privileges to Dedicated

Administrator Accounts

Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account. 1 1 1 1

45 6.1 Users…