3-13-AZ DOA-BPM0067-Solicitation Attachment-Arizona Baseline Infrastructure Security Controls (1).docx

Request for Proposal

Solicitation No. BPM006719

Statewide Emergency Response Solutions and Services Arizona Department of Administration State Procurement Office

Attachment 13 – AZ Baseline Infrastructure Security Controls Contractor shall follow the State of Arizona’s Data security policy standard (currently State of AZ Data Security Standard S8120) and Addendum B to the Special Terms and Conditions, titled Warranties and Requirements Related to Arizona Information Technology Statewide Policies, Standards, and Procedures when storing, processing, or transmitting State Data.

Contractor acknowledges and agrees that only National Institute of Standards and Technology (NIST) SP800-53 Security and Privacy Controls will be accepted for evaluation. No other forms of CSF will be accepted including ISO/IEC, SOC 2/3 reports, or other forms of self-attestations.

The State Data classification:

NIST Low Impact: If a Contractor may process, transmit, or store Public State Data (as per Statewide Information Security Policy P8110 Data Classification) and/or metadata during its work under the Contract, or as directed by the State Chief Privacy Officer (Arizona Department of Homeland Security, Governance, Risk, and Compliance team), then the Contractor shall follow the NIST Low Impact security controls.

NIST Moderate Impact: If a Contractor may process, transmit, or store Confidential State Data (as per Statewide Information Security Policy P8110 Data Classification) and/or metadata during its work under the Contract, or as directed by the State Chief Privacy Officer (Arizona Department of Homeland Security, Governance, Risk, and Compliance team), then the Contractor shall complete NIST Moderate Impact security controls.

Pursuant to State Data Classification Policy P8110 and the above Data classification, Contractor will have access to the following type of Data as part of its work under the Contract:

☐ Public State Data (AZRAMP 125 / NIST Low Impact) ☐ Confidential State Data (AZRAMP 325 / NIST Moderate Impact)

For this Offer to be considered, the Offeror shall follow the Infrastructure Security Controls and acknowledge its agreement below.

A) If the Offeror has achieved AZRAMP, FedRAMP, or StateRAMP Authorization, check the box below, submit certification information, and sign the signature section.

☐ AZRAMP Authorized ☐ FedRAMP Authorized ☐ StateRAMP Authorized

B) If the Offeror has not achieved AZRAMP, FedRAMP, or StateRAMP Authorization, complete the steps below, and sign the signature section.

Step B1: Solicitation Proposal Stage

Submit a completed AZRAMP Level 1 Prerequisite Control Sheet (https://azdohs.gov/sites/default/files/azramp-level-1-prerequisite-control-sheet_0.xlsx) (Attachment 14 - Prerequisite Assessment of Arizona Baseline Infrastructure Security Controls)

Step B2: Contract Award Stage:

If awarded a contract, the Contractor shall undergo and successfully complete an AZRAMP assessment within forty-five (45) days of award. If the Contractor will be using proprietary infrastructure to host the solution or service that will be handling State data, Contractor shall complete the appropriate AZRAMP control sheet based on the classification of the State Data involved: AZRAMP Level 2 Low Impact Control Sheet (https://azdohs.gov/sites/default/files/azramp-level-2-low-impact-control-sheet_0.xlsx) for Public State Data; or AZRAMP Level 3 Moderate Impact Control Sheet (https://azdohs.gov/sites/default/files/azramp-level-3-moderate-impact-control-sheet_0.xlsx) for Confidential State Data. If the Contractor will be using solely an environment provided by a Cloud Service Provider (CSP), the Contractor shall notify GRC@AZDOHS.gov of the CSP they will be using to handle State Data under this Contract. Supporting documentation required for the AZRAMP assessment includes, but is not limited to, the Contractor’s IT System Security Plan (SSP) or Written Information Security Program (WISP). Contractor may contact the AZDOHS GRC team with questions via GRC@AZDOHS.gov.

Step B3: Contract Management Stage: State is moving toward requiring Contractors to be StateRAMP Authorized. Once that move has become official, State will notify Contractors and Contractors will be required to:

B3.1 Register with StateRAMP (membership link: https://stateramp.org) within forty-five (45) days of notification and supply StateRAMP membership number to State Chief Privacy and Compliance Officer via GRC@AZDOHS.gov.

AND

B3.2 Within one (1) year of notification, Contractor shall obtain StateRAMP Authorization (authorized or provisional) of the appropriate Impact Level, or contact the State Chief Privacy and Compliance Officer via GRC@AZDOHS.gov for an extension to the one-year deadline.

Signature of person authorized to sign

Company Name

Printed name and title

Date

Contact email address

Contact phone number

StateRAMP Number

FedRAMP Number

Solicitation Attachment – AZ Baseline Infrastructure Security Controls | Revision No. 3 | Revised 09-24 image1.jpg