3524R13 - Vendor Security Requirements.pdf

Vendor Security Requirements 4.1.2026

EXHIBIT [*]

VENDOR SECURITY REQUIREMENTS

1. SCOPE; DEFINITIONS

a. Vendor Security Requirements Scope. This exhibit applies to Supplier’s performance under the agreement and all access, collection, use, storage, transmission, disclosure, destruction or deletion of, and security incidents regarding Commonwealth Information. This exhibit does not limit other obligations of Supplier, including under the agreement or laws that apply to Supplier, Supplier’s performance under the agreement, Commonwealth Information or the Permitted Purpose. To the extent this exhibit directly conflicts with the agreement, the Supplier shall promptly notify the Commonwealth of the conflict and shall comply with the requirement that provides the greatest protection of Commonwealth Information.

b. Definitions.

“Aggregate” means to combine or store Commonwealth Information with any data or information of Supplier or any third party.

“Anonymize” means to use, collect, store, transmit or transform any data or information (including Commonwealth Information) in a manner or form that does not identify, permit identification of, and is not otherwise attributable to any user, device identifier, source, product, service, context, brand, of the Commonwealth or its governmental entities.

“Commonwealth Information” means, individually and collectively: (a) all Commonwealth Confidential Information (as defined in the agreement or in the non-disclosure agreement between the parties); (b) all other data, records, files, content or information, in any form or format, acquired, accessed, collected, received, stored or maintained by Supplier or its affiliates from or on behalf of the Commonwealth or its governmental entities, or otherwise in connection with the agreement, the services, or the parties’ performance of or exercise of rights under or in connection with the agreement (including Commonwealth data); and (c) derived from (a) or (b), even if Anonymized.

“CONUS” means the continental United States and Hawaii.

“Extranet” means any of the following: a web portal, a non-public website, or extranet services of the Commonwealth’s or a third party’s website or system.

“In Bulk Access” means accessing data by means of database query, report generation, or any other mass transfer of data.

“MFA” means multi-factor authentication.

“Permitted Purpose” means providing services to the Commonwealth under the agreement and the licenses (if any) granted under the agreement.

“Security Incident” means actual or suspected unauthorized access, collection, acquisition, use, transmission, disclosure, corruption or loss of Commonwealth Information, or breach of any environment: (i) containing Commonwealth Information, or

(ii) managed by Supplier with controls substantially similar to those protecting Commonwealth Information.

“Subcontractors” means the Supplier’s subcontractors, vendors, affiliates, or delegates.

“Supplier” means the party identified in the contract or agreement to which this exhibit is attached that is responsible for providing the services and products.

“WAF” means web application firewall.

c. Authorized Use. Supplier may access, collect, use, store, and transmit only the

Commonwealth Information expressly authorized under the agreement and solely for the Permitted Purpose. Except as expressly authorized under the agreement, Supplier may not Aggregate Commonwealth Information, even if Anonymized. Unless the Commonwealth expressly consents in writing, Supplier may not transfer, rent, barter, trade, sell, rent, loan, lease or otherwise distribute or make available to any third party any Commonwealth Information.

2. VENDOR SECURITY REQUIREMENTS.

a. Basic Security Requirements. Supplier shall utilize industry best practices and standards

(and other requirements specified by the Commonwealth in the agreement, based on the classification and sensitivity of Commonwealth Information), to maintain physical, administrative and technical safeguards, and other security measures on its systems and networks to: maintain the security and confidentiality of Commonwealth Information accessed, collected, used, stored or transmitted by Supplier; and protect that information from known or reasonably anticipated threats or hazards to its security and integrity, accidental loss, alteration, disclosure and all other unlawful forms of processing.

Supplier shall comply with the following requirements:

1) Firewall. Supplier shall install and maintain a working WAF and network firewall to protect both Commonwealth applications and data accessible via the Internet.

2) Updates. Supplier shall keep its systems and software up-to-date with the latest upgrades, updates, bug fixes, patches, new versions and other modifications necessary to ensure security of the Commonwealth Information.

3) Anti-malware. Supplier shall use anti-malware software and keep the anti-malware software current. Supplier shall mitigate threats from all viruses, spyware, and other malicious code that are or should reasonably have been detected.

4) Encryption. Supplier shall encrypt data at rest and data in transit in accordance with applicable NIST standards, including algorithms and key sizes approved in NIST SP 800-175B.

5) Testing. Supplier shall regularly test its security systems and processes to ensure they meet the requirements of these Vendor Security Requirements, which includes but is not limited to third party vulnerability testing and penetration testing.

6) Access Controls. Supplier shall secure Commonwealth Information, by complying with the following requirements:

a) Assign a unique ID to each individual with computer access to Commonwealth Information.

b) Restrict access to Commonwealth Information to only its employees and Subcontractors with a “need-to-know” for the Permitted Purpose.

c) Review, at least every 90 days, the list of individuals and services with access to Commonwealth Information and remove accounts that no longer require access.

d) Not use manufacturer-supplied defaults for system passwords and other security parameters on any operating systems, software or other systems. Supplier shall mandate and ensure the use of system-enforced “strong passwords” in accordance with the best practices (described below) on all systems hosting, storing, processing, or that have or control access to, Commonwealth Information and shall require that all passwords and access credentials are kept confidential and not shared among personnel. Passwords must, at minimum, meet the following criteria:

a) Contain at least 8 characters;

b) Not match previous passwords, the user’s login, or common name;

c) Be changed whenever an account compromise is suspected or assumed; and

d) Be changed at least every 90 days;

e) Not be composed of dictionary words, repetitive or sequential characters, or any password found in known-compromised password lists (checked against a regularly updated blacklist);

f) MFA must be required for privileged accounts and for remote access to systems containing sensitive data.

e) Maintain and enforce “account lockout” by disabling accounts with access to Commonwealth Information when an account exceeds more than five (5) consecutive incorrect password attempts.

f) Unless authorized by the Commonwealth in writing, Supplier shall isolate the Commonwealth Information at all times (including in storage, processing or transmission), from Supplier’s and any third-party information.

g) Implement and use additional physical access control measures requested in writing by the Commonwealth.

h) Prepare and provide the Commonwealth with an annual report, or upon request by the Commonwealth, detailing (1) log data about all use (both authorized and unauthorized) of the Commonwealth’s accounts or credentials provided to Supplier for use on behalf of the Commonwealth (e.g., social media account credentials), and (2) detailed log data about any impersonation of, or attempt to impersonate, Commonwealth personnel or Supplier personnel with access to Commonwealth Information.

i) Monitor and continually review, using automated alerting and, at least weekly, using human review of all relevant system, application and security access logs to detect indicators of malicious activity, unauthorized access or anomalous behavior. Suspected or confirmed incidents shall be reported to the Commonwealth as outlined in Section 2(f) (Security Incidents).

7) Supplier Policy. Supplier shall maintain and enforce an information and network security policy for its employees, Subcontractors and agents that meets the standards in this policy, including methods to detect and log policy violations.

Upon request by the Commonwealth, Supplier shall provide information on violations of Supplier’s information and network security policy, regardless of whether the violations constitute a Security Incident.

8) Subcontract. Supplier shall not subcontract or delegate any of its obligations under this exhibit to any Subcontractors without the Commonwealth’s prior written consent. Notwithstanding the existence or terms of any subcontract or delegation, Supplier is responsible for compliance with its obligations under this exhibit.

Supplier shall ensure this exhibit is binding upon Supplier’s Subcontractors and personnel, include it in any subcontract, and made known to Subcontractor’s personnel. Supplier (a) shall ensure that its Subcontractors and personnel comply with this exhibit, and (b) is responsible for all acts, omissions, negligence and misconduct of its Subcontractors and personnel.

9) Remote Access. Supplier shall require MFA for any access from outside protected corporate or production environments to systems holding Commonwealth

Information or Supplier’s corporate or development workstation networks require (e.g., requires at least two separate factors for identifying users).

10) Geographical Limitations. Commonwealth Information may only be hosted, handled, processed, or accessed in physical locations within CONUS by the Supplier and its Subcontractors, personnel, and anyone acting on the Supplier’s behalf.

11) In Bulk Access. Except where expressly authorized by the Commonwealth in writing, Supplier may not access, and shall not permit In Bulk Access to Commonwealth Information whether the Commonwealth Information is in a Commonwealth- or Supplier- controlled database or stored in any other method, including storage in file-based archives (e.g., flat files), etc. Specifically, this section prohibits any access to Commonwealth Information except for access to individual records as needed for the Permitted Purpose. Supplier shall preserve detailed log data on attempted or successful In Bulk Access to Commonwealth Information and provide reports from these logs as part of its obligations under Section 2(e) (Security Review). If the Commonwealth provides written authorization for In Bulk Access to Commonwealth Information, the Supplier shall:

a) limit such access only to specified employees with the ”need to know;”

b) use tools that limit access and require explicit authorization for access; and

c) all access must be logged.

12) Supplier Personnel. The Commonwealth may condition access to Commonwealth Information by Supplier personnel on the execution and delivery of individual nondisclosure agreements in a form specified by the Commonwealth. If individual nondisclosure agreements are required, Supplier shall obtain and deliver signed copies to the Commonwealth prior to granting access to any Commonwealth information.

In addition, Supplier shall ensure that all Supplier personnel who have access to Commonwealth Information or facilities successfully complete appropriate background checks in accordance with applicable laws and Commonwealth standards prior to being granted access. At a minimum, background checks shall include verification of identity, employment history, criminal record review and confirmation that the individual has not been convicted of offenses involving fraud, theft or the misuse of confidential information. The Supplier shall maintain documentation of completed background checks and provide confirmation of compliance to the Commonwealth upon request. Supplier shall also:

a) maintain a list of all Supplier personnel who have accessed or received

Commonwealth Information and provide that list to the Commonwealth upon request within an agreed upon timeframe.

b) notify the Commonwealth no later than 24 hours after any specific individual Supplier personnel authorized to access Commonwealth Information in accordance with this Section:

i. no longer needs access to Commonwealth Information; or

ii. no longer qualifies as Supplier personnel (e.g., the personnel leaves

Supplier’s employment).

13) Artificial Intelligence (AI). Supplier shall not use Commonwealth data for AI training, model refinement, or algorithm development All Commonwealth data and any outputs, analysis, or results derived from any AI system, tool or model remain the sole property of the Commonwealth. Supplier shall disclose any AI used in service delivery and ensure full compliance with Commonwealth standards and applicable data protection laws.

14) Security Review and Reporting. Supplier shall perform a security review of its products, systems, and any third party systems and their security controls by an independent third party and provide Commonwealth with periodic reporting, on at least an annual basis, about the security controls in the format requested by the Commonwealth (e.g., SOC 2 Type 2, ISO 27001), or other recognized industry-standard report approved by the Commonwealth.

b. Access to Commonwealth Extranet and Supplier Portals. The Commonwealth may grant

Supplier access to Commonwealth Information via an Extranet for the Permitted Purpose.

If the Commonwealth permits Supplier to access any Commonwealth Information using an Extranet, Supplier must comply with the following requirements:

1) Authorized Access. Supplier and its personnel shall access the Extranet and access, collect, use, view, retrieve, download or store Commonwealth Information from the Extranet solely for the Permitted Purpose.

2) Accounts. Supplier shall ensure that Supplier personnel use only the Extranet accounts designated for each individual by the Commonwealth and shall require Supplier personnel to keep their access credentials confidential.

3) Systems. Supplier shall access the Extranet only through computing or processing systems or applications running operating systems managed by Supplier and that include:

a) system network firewalls in accordance with Section 2(a)(1) (Firewall);

b) centralized patch management in compliance with Section 2(a)(2) (Updates);

c) operating system appropriate anti-malware software in accordance with

Section 2(a)(3) (Anti-malware); and

d) for portable devices, shall be encrypted in accordance with current NIST guidance.

4) Restrictions. Unless approved in advance in writing by the Commonwealth, Supplier shall not download, mirror or permanently store any Commonwealth Information from any Extranet on any medium, including any machines, devices or servers.

5) Account Termination. Supplier shall terminate the account of, and notify the Commonwealth within 24 hours, any Supplier personnel who:

a) no longer needs access to Commonwealth Information; or

b) no longer qualifies as Supplier personnel (e.g., the personnel leaves

Supplier’s employment).

6) Third Party Systems.

a) Supplier shall give the Commonwealth prior notice and obtain the Commonwealth’s prior written approval before the Supplier uses any third-party system that stores or may otherwise have access to Commonwealth Information, unless:

i. the data shall be encrypted at rest and in transit in accordance with the then-current NIST guidance, and

ii. the third-party system does not have access to the decryption key or unencrypted “plain text” versions of the data.

The Commonwealth reserves the right to require a security review by the Commonwealth (in accordance with Section 2(e) (Security Review)) of the third-party system before giving approval.

b) If Supplier uses any third party systems that store or otherwise may access Commonwealth Information, Supplier shall perform a security review of the third party systems and their security controls by an independent third party and provide Commonwealth with periodic reporting about the third party system’s security controls in the format requested by the Commonwealth (e.g., SOC 2 Type 2, ISO 27001), or other recognized industry-standard report approved by the Commonwealth.

c. Data Retention and Destruction.

1) Retention. Supplier shall retain Commonwealth Information only for, and as long as is necessary, the Permitted Purpose.

2) Return or Deletion. Supplier shall promptly (within 72 hours) return to the Commonwealth, and permanently and securely delete all Commonwealth Information in its possession, upon and in accordance with the Commonwealth’s notice requiring return or deletion. The Supplier shall return the Commonwealth Information to the Commonwealth in the format designated by the Commonwealth.

Supplier shall permanently and securely delete all live (online or network accessible) instances of the Commonwealth Information within 60 days after the earlier of: 1) completion of the Permitted Purpose or 2) termination or expiration of the agreement. If requested by the Commonwealth, Supplier shall certify in writing that all Commonwealth Information has been destroyed.

3) Archival Copies. If Supplier is required by law to retain archival copies of Commonwealth Information for tax or similar regulatory purposes, this archived Commonwealth Information must be stored in one of the following ways:

a) As a “cold” or offline (i.e., not available for immediate or interactive use) backup stored in a physically secure facility; or

b) Encrypted at rest in accordance with then-current NIST guidance, using cryptographic protections commensurate with the sensitivity of the data and retention period, where the system hosting or storing the encrypted file(s) does not have access to a copy of the key(s) used for encryption.

4) Backup. Supplier shall utilize a secured backup solution to prevent loss of data.

Stored backups must be kept in an all-hazards protective storage environment at the primary location and any additional locations where data is being maintained.

All back up data and media must be encrypted in accordance with the requirements of this exhibit.

5) Recovery. If Supplier performs a “recovery” (i.e., reverting to a backup) for the purpose of disaster recovery, Supplier shall have and maintain a process that ensures that all Commonwealth Information that is required to be deleted pursuant to the agreement or these Vendor Security Requirements shall be re-deleted or overwritten from the recovered data in accordance with this Section 2(c) within 24 hours after recovery occurs. If Supplier performs a recovery for any purpose, no Commonwealth Information may be recovered to any third-party system or network without the Commonwealth’s prior written approval. The Commonwealth may conduct a security review (in accordance with Section 2(e) (Security Review)) of the third-party system or network before permitting recovery of any Commonwealth Information to any third-party system or network.

6) Deletion Standards. All Commonwealth Information deleted by Supplier shall be deleted in accordance with the NIST Special Publication 800-88 Revision 1, Guidelines for Media Sanitation (available at http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf), or through degaussing of magnetic media in an electromagnetic flux field of 5000+ GER, or by shredding or mechanical disintegration, or such other standards the Commonwealth may require based on the classification and sensitivity of the Commonwealth Information. With respect to the Commonwealth Information encrypted in compliance with this exhibit, this deletion may be done by permanently and securely deleting all copies of the keys used for encryption.

d. Forensic Destruction. Before disposing in any manner of any hardware, software, or any other media that contains, or has at any time contained, Commonwealth Information, Supplier shall perform a complete forensic destruction of the hardware, software or other media so that none of the Commonwealth Information can be recovered or retrieved in any form. Supplier shall perform forensic destruction in accordance with the standards Commonwealth may require based on the classification and sensitivity of the Commonwealth Information. For Commonwealth Information that that has not been forensically destroyed, Supplier may not sell, resell, donate, refurbish, or otherwise transfer the hardware, software or other media.

e. Security Review.

1) Risk Assessment Questionnaire. The Commonwealth may periodically request

Supplier to complete a new Commonwealth risk assessment questionnaire.

2) Certification. Upon Commonwealth’s written request, Supplier shall certify in writing to the Commonwealth that it complies with this exhibit and the agreement.

3) Other Reviews. The Commonwealth may periodically review the security of systems that Supplier uses to process Commonwealth Information. Supplier shall cooperate and provide the Commonwealth with all required information within a reasonable time frame, but no more than 20 calendar days from the date of the Commonwealth’s request.

4) Remediation. If any security review identifies any deficiencies, Supplier shall, at its sole cost and expense take all actions necessary to remediate those deficiencies within an agreed upon timeframe.

f. Security Incidents.

1) Supplier shall inform the Commonwealth at OA-SecurityIncidents@pa.gov within 24 hours of a confirmed Security Incident or when it reasonably suspects there was a Security Incident. Supplier shall remedy each Security Incident in a timely manner and provide the Commonwealth written details regarding Supplier’s internal investigation regarding each Security Incident. Supplier shall not notify any regulatory authority, nor any customer, on behalf of the Commonwealth, unless the Commonwealth specifically requests, in writing, the notification. the Supplier will http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf provide the Commonwealth an opportunity to review and approve the form and content of any notification before it is provided to any party. Supplier shall fully cooperate and work with the Commonwealth to formulate and execute a plan to rectify all confirmed Security Incidents.

2) Supplier shall inform the Commonwealth within 24 hours when Commonwealth data is being sought in response to legal process or by applicable law (e.g. 18 U.S.C. §2705(b)).

g. Accessibility.

1) All information systems, applications and digital content provided under this agreement must comply with the Commonwealth’s digital accessibility standards and applicable laws, including Section 508 of the Rehabilitation Act and WCAG

2.1 AA guidelines.

2) Suppliers shall ensure that all user interfaces, electronic documents and communications are accessible to individuals with disabilities. Accessibility testing and remediation, including automated and manual testing with assistive technologies, must be incorporated into all development and implementation activities.

3) Suppliers shall provide accessibility conformance documentation (e.g., VPAT or ACR) upon delivery and at each major release. Upon request, supplier shall provide documentation verifying compliance or a remediation plan for any identified deficiencies.