524-24_SMART_Grant_Software_Developer_Supplement_S_-_State_Information_Security_Privacy_and_Data_Handling_Requirements_2.0_Etch_.pdf

State of Ohio Department of Administrative Services / Office of Information Technology Supplement S, State Information Security, Privacy, and Data Handling Requirements

Supplement S State Information Security, Privacy, and Data Handling

Requirements

Revision History:

Date: Description of Change: Version

10/01/2019

Updated the State Information Security and Privacy Requirements as well as the State Data Handling Requirements to align with current practices.

1.0

03/29/2022 Changed SSAE from 16 to 18 1.0

06/05/2023 Updated overall document 2.0

Page | i

Table of Contents Page

State Information Security, Privacy, and Data Handling Requirements Instructions

Definitions

Overview and Scope

State Requirements Applying to All Solutions

1. State Information Security and Privacy Standards and Requirements

1.1. The Contractor's Responsibilities Generally

1.2. The State’s Rights and Responsibilities Generally

1.3. Solution Security and Data Protection Controls

1.4. Data Security and Privacy Plans and Assessments

1.4.1. System Security Plan

1.4.2. Risk Assessment

1.4.3. Vulnerability Scans

1.4.4. Compliance Scans

1.5. Periodic State Security, Data Protection, and Privacy Audits and Testing

1.5.1. Security and Data Protection Audits and Issue Resolution

1.5.2. State Penetration and Controls Testing

1.6. Protection and Handling of State Data

1.7. Contractor Access to State Network Systems and Data

1.8. Portable Devices and Media

2. State and Federal Regulatory Data Security and Privacy Requirements

2.1. Applicable Regulatory Data Security and Privacy Requirements

2.2. Federal Tax Information (FTI)

2.2.1. IRS 1075 Performance Requirements

2.2.2. IRS 1075 Criminal/Civil Sanctions

2.2.3. Inspection

2.3. Health Insurance Portability and Accountability Act (HIPAA)

2.4. Permitted Disclosure to Third Parties

2.5. Background Investigations of Contractor Personnel

3. Security Incidents

3.1. Definition of a Security Incident

3.2. Security Incident Reporting

3.3. Security Incident Response

4. Contractor Security Review and Reporting Requirements

4.1. Hardware and Software Assets

Page | ii

4.2. Boundary Defenses

4.3. Audit Log Reviews

4.4. Application Software Security

4.5. System Administrator Access

4.6. Account Management and Access Privileges

5. Supplement Review and Updates

Appendix A – Compensating Controls to this Supplement

Page | 1

Office of Information Security and Privacy

Main Number: 614-644-9391

30 E Broad Street, 19th Floor

Columbus, Ohio 43215 infosec.ohio.gov

State Information Security, Privacy, and Data Handling Requirements Instructions

When providing a response to this Supplement S, State Information Security, Privacy, and Data Handling Requirements (the “Supplement”), please follow the instructions below and frame your response as it relates to your proposed solution e.g., cloud (Software as a Service, Platform as a Service, or Infrastructure as a Service), on-premises, or hybrid. Resellers of a service or solution must work with the Provider to complete a Supplement with information from the Provider applicable to that specific service or solution. Resellers remain responsible for the requirements in this Supplement pursuant to the Contract.

1. After each specific requirement that includes a response box like the example below, the

Contractor must provide a response on how the requirement will be met or indicate if it is not applicable and why.

2. The Contractor may only provide responses in the spaces provided.

3. Please note that any proposed Compensating Controls to the security and privacy requirements outlined in this Supplement are required to be identified in Appendix A – Compensating Controls to this Supplement. Contractors are asked not to make any modifications or redlines to the language contained within this Supplement.

Please be sure to provide a rationale for the change. Some sections in this Supplement may indicate that no Compensating Controls are permitted, and no Compensating Controls may be listed in Appendix A for those specific sections.

4. Upon completion, please submit the responses to this Supplement as directed.

Definitions

Page | 2

1. Contractor means the entity or individual identified below. If applicable, also identify the Provider below. For the purposes of this Supplement, the term Contractor includes the Provider and any subcontractors or other personnel under the authority or control of the Contractor.

Please provide the following information in the space below: Entity or individual name, address, e-mail point of contact for this Supplement, and associated contract or RFP number.

Etch, LTD Darlene Magold, CEO Darlene@etchgis.com 524-24 SMART Grant Software Developer

2. Contract means the contract or RFP listed above under Contractor.

3. Compensating Controls means security and/or privacy controls implemented in lieu of the controls described in this Supplement, as provided by Contractor in its responses or in Appendix A.

4. Provider means the entity providing the service or solution if the Contract is between the State and a reseller for the service or solution.

5. Security Incident has the meaning set forth in Section 3.1 of this Supplement.

6. State Data means all data and information provided by, created by, created for, or related to the activities of the State and any information from, to, or related to all persons that conduct business or personal activities with the State, including, but not limited to Sensitive Data.

7. Sensitive Data means any type of data that presents a high or moderate degree of risk if released, disclosed, modified, or deleted without authorization. There is a high degree of risk when unauthorized release or disclosure is contrary to a legally mandated confidentiality requirement. There may be a moderate risk and potentially a high risk in cases of information for which an agency has discretion under the law to release data, particularly when the release must be made only according to agency policy or procedure.

Sensitive Data includes, but is not limited to:

A. Certain types of personally identifiable information (PII) that is also sensitive, such as medical information, social security numbers, and financial account numbers;

B. Federal Tax Information (FTI) under IRS Publication 1075;

C. Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA);

D. Criminal Justice Information (CJI) under the Federal Bureau of Investigation’s Criminal Justice Information

Services (CJIS) Security Policy and the Law Enforcement Automated Data System (LEADS) Policy; and E. Other types of information not associated with an individual such as security and infrastructure records, trade secrets, and business bank account information.

F. Social Security Administration (SSA) Data which is data received by the State from the Social Security

Administration in accordance with the current Computer Matching and Privacy Protection Act between the State of Ohio and the Social Security Administration.

8. State IT Security Policies and Standards means the policies and standards available at https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance.

Overview and Scope

This Supplement applies to all work and services across all environments, and State and Contractor locations (e.g., cloud (Software as a Service, Platform as a Service, or Infrastructure as a Service), on-premises, or hybrid) mailto:Darlene@etchgis.com https://das.ohio.gov/technology-and-strategy/information-security-privacy/information-security-governance

Page | 3 along with the computing elements that the Contractor will perform, provide, occupy, or utilize in performing the work, and any Contractor access to State resources in conjunction with the delivery of work.

The Contractor will accept the security and privacy requirements outlined in this Supplement in their entirety as they apply to the services being provided to the State. The Contractor will be responsible for maintaining information security in any environments under the Contractor’s management and in accordance with State IT Security Policies and Standards.

This Supplement specifically applies to:

A. Major and minor projects, upgrades, updates, fixes, patches, and other software and systems inclusive of all State elements or elements under the Contractor’s responsibility utilized by the State.

B. Any systems development, integration, operations, and maintenance activities performed by the Contractor.

C. Any authorized change orders, statements of work, renewals, or amendments to the applicable contracts.

D. Contractor locations, equipment, and personnel that access State systems, networks, or State Data directly or indirectly.

E. Any Contractor personnel or sub-contracted personnel that have access to State Data.

The terms in this Supplement are in addition to the Contract terms and conditions. In the event of a conflict between the Contract and this Supplement, the most stringent standard will prevail.

The headings in this Supplement are for convenience only and will not affect the interpretation of any of the provisions.

Page | 4

State Requirements Applying to All Solutions

This Supplement describes the responsibilities for both the Contractor and the State of Ohio relating to State information security and privacy standards and requirements for all proposed solutions, whether cloud, on-premises, or hybrid based. The Contractor will comply with State IT Security Policies and Standards as they apply to the services being provided to the State.

1. State Information Security and Privacy Standards and Requirements

1.1. The Contractor’s Responsibilities Generally

The Contractor is responsible for maintaining the security of information in accordance with State IT Security Policies and Standards. If the State is providing the network layer, the Contractor must be responsible for maintaining the security of the information in environment elements that are accessed, utilized, developed, or managed by the Contractor. In either scenario, the Contractor must implement information security policies, standards, and capabilities as set forth in the Contract, adhere to State IT Security Policies and Standards, and use procedures in a manner that does not diminish established State capabilities and standards. All work performed by the Contractor, all deliverables provided by the Contractor, and all environments utilized to perform the Contractor’s work must comply with State IT Security Policies and Standards.

The Contractor’s information security and technology responsibilities with respect to the work and services the Contractor is providing to the State include the following, where applicable:

1.1.1. Support State IT security policies, standards and procedures development and maintenance activities.

Assist in the implementation of associated security procedures with the State’s review and approval, including physical access requirements, User ID approval procedures, and a security incident action and response plan.

1.1.2. Support implementation and compliance monitoring as per State IT Security Policies and Standards.

1.1.3. Upon identification of a potential issue with maintaining an “as provided” State infrastructure element in accordance with a more stringent State level security policy, the Contractor must identify and communicate the nature of the issue to the State, and, if possible, outline potential remedies for consideration by the State.

1.1.4. Support intrusion detection and prevention, including prompt State notification of such events, and reporting, monitoring, and assessing security events.

1.1.5. Support vulnerability scanning, assessment, and remediation efforts of the State.

1.1.6. Manage and administer access to the systems, networks, system software, systems files, State Data, and end users if applicable.

1.1.7. Install and maintain current versions of software (including system and security software), assign and reset passwords per established procedures, provide the State access to create User IDs, suspend and delete inactive User IDs, research system security problems, maintain network access authority, assist in processing State security requests, perform security reviews to confirm that adequate security procedures are in place on an ongoing basis, provide incident investigation support (jointly with the State), and provide environment and server security support and technical advice.

Page | 5

1.1.8. Develop, implement, and maintain a set of automated and manual processes to ensure that data access rules are not compromised.

1.1.9. Perform physical security functions (e.g., identification badge controls and alarm responses) at the facilities under the Contractor’s control.

Please explain how these requirements will be met within the context of the proposed solution (e.g., Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), On- Premises or Hybrid). If this section, or portions of this section, are not applicable, please explain and note as N/A. Please note that any proposed Compensating Controls and/or requirement modifications must be noted in Appendix A - Compensating Controls to Security and Privacy Requirements. The language within this Supplement will not be modified.

The proposed solution will utilize the State’s SaaS OH|ID solutions to ensure adherence to the State’s Security and Privacy Standards and Requirements. This will ensure access to any information is done behind a secure layer. Although some moove.ai elements may be proprietary, moove.ai will comply with the sections outlined in 1.1.1-1.1.9.

1.2. The State’s Rights and Responsibilities Generally

The Department of Administrative Services (DAS) Office of Information Security and Privacy supports the productivity, innovation, and organizational objectives of the State in providing secure services to the people of Ohio. The DAS Office of Information Security and Privacy provides the technology, policies, standards, architecture, information, and solutions to enhance the privacy and security of Ohio's data and systems.

The DAS Office of Information Security and Privacy works with state agencies as they implement information security and privacy practices for their systems and services. As the enterprise security and privacy office, it provides information security governance, privacy direction, awareness resources, and enterprise incident response. In addition to those functions, the DAS Office of Information Security and Privacy provides information security services to agencies and performs security operations. In doing so, the State has the following rights and responsibilities, in addition to the other provisions in this Supplement:

1.2.1. Develop, maintain, and update the State IT Security Policies and Standards, including applicable State information risk policies, standards, and procedures.

1.2.2. Provide the Contractor with contact information for security and program personnel for incident reporting purposes.

1.2.3. Provide a State resource to serve as a single point of contact, with responsibility for account security audits.

1.2.4. Support intrusion detection, prevention, and vulnerability scanning, assessment, and remediation pursuant to State IT Security Policies and Standards.

1.2.5. Conduct audits as more specifically described in this Supplement.

1.2.6. Provide applicable audit information for the services provided by the Contractor and any subsequent updates to the audit information.

1.2.7. Assist the Contractor in performing identification, authorization, and access control services, and provide authorization of those services, as needed (refer to Section 4 for additional details).

Page | 6

1.2.8. Classify applicable data per Ohio Administrative Policy IT-13, “Data Classification,” and communicate the classification to the Contractor.

1.3. Solution Security and Data Protection Controls

Per the classification of data from subsection 1.2.8 above, and per the sensitivity and criticality of the data, the solution must operate at the appropriate baseline. Unless otherwise specified, the appropriate baseline is moderate at a minimum, as defined in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations” (current, published version). The solution must be consistent with Federal Information Security Management Act (“FISMA 2014”) requirements and offer a customizable and extendable capability based on open-standards APIs that enable integration with third party applications. The solution must provide the State’s systems administrators with 24x7 visibility into the services through a real-time web-based “dashboard” capability that enables them to monitor, in real or near real time, the services’ performance against the established service level agreements and promised operational parameters.

If the solution is cloud based, the Contractor must obtain an annual audit that meets the American Institute of Certified Public Accountants (AICPA) Statements on Standards for Attestation Engagements (“SSAE”) No. 18 (or the most current version), Service Organization Control 1 Type 2 and Service Organization Control 2 Type 2. The audit must cover all operations pertaining to the work covered by the Contract. The audit will be at the sole expense of the Contractor and the results must be provided to the State within 30 days of its completion each year.

At no additional cost to the State, the Contractor must immediately remedy any issues, material weaknesses, or other items identified in each audit as they pertain to the Contract work.

Please explain how these requirements will be met within the context of the proposed solution (e.g., Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), On- Premises or Hybrid). If this section, or portions of this section, are not applicable, please explain and note as N/A. Please note that any proposed Compensating Controls and/or requirement modifications must be noted in Appendix A - Compensating Controls to Security and Privacy Requirements. The language within this Supplement will not be modified.

The team will perform automated audits throughout the lifetime of the proposed solution to ensure compliance.

1.4. Data Security and Privacy Plans and Assessments

1.4.1. System Security Plan - A completed System Security Plan must be provided by the Contractor to the State, if requested by the State, no later than the end of the project development phase of the System Development Life Cycle (SDLC). Such plan, and any updates or amendments to the plan, will become part of this Supplement as if fully rewritten herein. The plan must be updated annually or when major changes occur within the solution if the changes occur earlier than the annual update. The template referenced below is the preferred format for submitting System Security Plans to the State.

Ohio Security Plan

Template.docx

Page | 7

1.4.2. Risk Assessment - A risk assessment report completed within the past 12 months must be provided to the State and the DAS Office of Information Security and Privacy no later than the project development phase of the System Development Life Cycle (SDLC). A new risk assessment must be conducted every two years, or because of significant changes to infrastructure, a system or application environment, or following a significant security incident, and an updated risk assessment report must be provided to the State after conducting each risk assessment.

1.4.3. Vulnerability Scans – Provide vulnerability management services (including scans, assessments, and remediation) for the Contractor’s internal secure network connection, including supporting remediation for identified vulnerabilities as agreed. At a minimum, the Contractor must provide vulnerability scan results to the State at least quarterly, or as otherwise agreed to with the State.

1.4.4. Compliance Scans – The Contractor must:

1.4.4.1. Document security standards by device type and execute compliance scans at least quarterly against these standards and produce exception reports, if any.

1.4.4.2. If exceptions are found, document and implement a process for any required remediation for the exceptions identified in the reports from 1.4.4.1 above. If an exception cannot be remediated, Contractor must provide sufficient justification for the exception and the applicable Compensating Controls. Contractor must provide to the State the scan results, exception reports and any justifications described in 1.4.4.1 and 1.4.4.2.

1.4.4.3. If no exceptions are found, either provide to the State the scan results from 1.4.4.1 above or provide an attestation to the State to that effect, upon request.

Please explain how these requirements will be met within the context of the proposed solution (e.g., Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), On- Premises or Hybrid). If this section, or portions of this section, are not applicable, please explain and note as N/A. Please note that any proposed Compensating Controls and/or requirement modifications must be noted in Appendix A - Compensating Controls to Security and Privacy Requirements. The language within this Supplement will not be modified.

We will provide the State with any and all requested and required security plans, risk assessments plans, vulnerability scans, and compliance scans.

1.5. Periodic State Security, Data Protection, and Privacy Audits and Testing

1.5.1. Security and Data Protection Audits and Issue Resolution

The State may, at any time in its sole discretion, elect to perform a Security and Data Protection Audit as set forth in this subsection. This includes a thorough review of Contractor controls, security and privacy functions and procedures, data storage and encryption methods, and backup and restoration processes.

The State may utilize a third-party contractor to perform such activities to demonstrate that all security, privacy, and encryption requirements are met.

The State or any entity with audit rights may conduct periodic security and privacy audits at its own cost and will utilize members of the DAS Office of Information Security and Privacy, the Office of Budget and Management – Office of Internal Audit, and the Auditor of State, depending on the focus area of the audit.

Page | 8

The Contractor must fully cooperate with the State or auditing entity during any such audits. Should an audit issue or finding be discovered, the following resolution path will apply:

The Contractor is responsible for resolving any security or privacy issues that exist in any of the IT resources they provide to the State at the Contractor’s cost. If a security or privacy issue exists in any of the IT resources furnished to the Contractor by the State (e.g., code, systems, computer hardware and software), the State will have responsibility to address or resolve the issue. The State may elect to work with the Contractor under mutually agreeable terms for resolution services, or the State may elect to address the issue independently of the Contractor.

Any findings, gaps, errors, or omissions found during a State audit must be resolved to the State’s satisfaction, and the Contractor will not proceed with Contract work until the State tests and approves the Contractor’s resolution of any such findings, gaps, errors, or omissions.

Please explain how these requirements will be met within the context of the proposed solution (e.g., Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), On- Premises or Hybrid). If this section, or portions of this section, are not applicable, please explain and note as N/A. Please note that any proposed Compensating Controls and/or requirement modifications must be noted in Appendix A - Compensating Controls to Security and Privacy Requirements. The language within this Supplement will not be modified.

We will address any security or privacy issue found by the State or third-party within a reasonable and agreed-to timeframe that benefits all parties involved.

1.5.2. State Penetration and Controls Testing - The State reserves the right to either: 1) request to conduct security penetration testing of the applicable solution or any environments that may impact the solution or any State environments, and may utilize a third party contractor to perform such testing at its discretion;

or 2) request penetration testing reports performed by independent third-party contractors of the same from the Contractor. Penetration testing may be conducted internally or externally on the hardware, software, or firmware components of a system, can test both physical and technical controls, and can be performed by either the State or an independent third-party contractor. The Contractor and the State must agree upon the scope of testing prior to conducting any testing under this section.

1.6. Protection and Handling of State Data

To protect State Data as described in this Supplement, the Contractor must use due diligence to ensure computer and telecommunications systems and services involved in storing, using, or transmitting State Data are secure and to protect State Data from unauthorized disclosure, modification, use or destruction.

To accomplish this, the Contractor must adhere to the following requirements regarding State Data in addition to the confidentiality requirements in the Contract:

1.6.1. Maintain, in confidence, State Data it may obtain, maintain, process, or otherwise receive from or through the State during, and pursuant to, the provisions of the Contract and this Supplement.

1.6.2. Use and permit its employees, officers, agents, and subcontractors to use any State Data received from the State solely to perform its obligations under the Contract.

Page | 9

1.6.3. Not sell, rent, lease, disclose, or permit its employees, officers, agents, and sub-contractors to sell, rent, lease, or disclose, any such State Data to any third party, except as permitted under the Contract or required by applicable law, regulation, or court order.

1.6.4. Take all commercially reasonable steps to (a) protect the confidentiality of State Data received from the State and (b) establish and maintain physical, technical, and administrative safeguards to prevent unauthorized access by third parties to State Data received by the Contractor from the State.

1.6.5. Apply appropriate risk management techniques to balance the need for security measures against the sensitivity of State Data.

1.6.6. Ensure that internal security policies, plans, and procedures address the basic security elements of confidentiality, integrity, and availability of State Data, and periodically review and update these policies, plans, and procedures as needed.

1.6.7. Align with existing State IT Security Policies and Standards designed to ensure the following:

1.6.7.1. Security and confidentiality of State Data;

1.6.7.2. Protection against anticipated threats or hazards to the security or integrity of State Data; and

1.6.7.3. Protection against the unauthorized access to, disclosure of, or use of State Data.

1.6.8. Maintain appropriate identification and authentication processes for information systems and services associated with State Data.

1.6.9 Maintain appropriate access control and authorization policies, plans, and procedures to protect system assets and other information resources associated with State Data.

1.6.10. Give access to State Data only to those individual employees, officers, agents, and sub-contractors who need to know such information in connection with the performance of the obligations under the Contract.

1.6.11. Any data encryption requirement identified in this Supplement means encryption that complies with NIST’s Federal Information Processing Standard 140-2 as demonstrated by a valid FIPS certificate number.

1.6.12. Any Sensitive Data at rest, transmitted over a network, or taken off-site via portable and/or removable media if necessary, must be encrypted pursuant to the State’s data encryption standard, Ohio IT Standard ITS-SEC-01, “Data Encryption and Cryptography,” and Ohio Administrative Policy IT-14, “Data Encryption and Securing State Data.”

1.6.13. Maintain plans and policies that include methods to protect against security and integrity threats and vulnerabilities, as well as detect and respond to those threats and vulnerabilities.

1.6.14. Implement and manage security audit logging on information systems, including computers and network devices.

1.6.15. Cooperate with any attempt by the State to monitor compliance with the foregoing obligations as reasonably requested by the State.

Page | 10

1.6.16. Promptly destroy or return to the State, in a format designated by the State, all State Data received from or through the State upon completion of the work under the Contract or upon termination or expiration of the Contract.

Please explain how these requirements will be met within the context of the proposed solution (e.g., Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), On- Premises or Hybrid). If this section, or portions of this section, are not applicable, please explain and note as N/A. Please note that any proposed Compensating Controls and/or requirement modifications must be noted in Appendix A - Compensating Controls to Security and Privacy Requirements. The language within this Supplement will not be modified.

Our team will work closely with the State to ensure all the requirements above our met. All work being done will require authentication to the necessary documents, code bases, etc. with any additional level of security including, but not limited to, user roles and access.

1.7. Contractor Access to State Network Systems and Data

When the Contractor accesses State network systems and data, including remotely, the Contractor must maintain a robust boundary security capability that incorporates generally recognized system hardening techniques. This includes determining which ports and services are required to support access to systems that hold State Data, limiting access to only these ports, and disabling all others.

To do this, the Contractor must:

1.7.1. Use assets and techniques such as properly configured firewalls, a demilitarized zone for handling public traffic, host-to-host management, Internet protocol specification for source and destination, strong authentication, encryption, packet filtering, activity logging, and implementation of system security fixes and patches as they become available.

1.7.2. Use multifactor authentication to limit access to systems that contain Sensitive Data.

1.7.3. Assume all State Data is both confidential and critical for State operations. The Contractor’s security policies, plans, and procedures for the handling, storage, backup, access, and, if appropriate, destruction of State Data must be commensurate to the moderate security baseline as defined in NIST Special Publication (SP) 800-53 unless the State instructs the Contractor otherwise in writing.

1.7.4. Employ appropriate intrusion and attack prevention and detection capabilities. Those capabilities must track unauthorized access and attempts to access State Data, as well as attacks on the Contractor’s infrastructure associated with the State Data. Further, the Contractor must monitor and appropriately address information from its system tools used to prevent and detect unauthorized access to and attacks on the infrastructure associated with the State Data.

1.7.5. Use appropriate measures to ensure that State Data is secure before transferring control of any systems or media on which State Data is stored. The method of securing the State Data must be in alignment with the required data classification and risk assessment outcomes, and may include secure overwriting, destruction, or encryption of the State Data before transfer of control in alignment with Ohio Administrative Policy IT-05, “Disposal, Servicing, and Transfer of IT Equipment,” and NIST SP 800-88.

The transfer of any such system or media must be reasonably necessary for the performance of the Contractor’s obligations under the Contract.

Page | 11

1.7.6. Have a business continuity plan in place that the Contractor reviews, tests, and updates no less than annually and makes such plan and test results available to the State upon request. The plan must address procedures for responses to emergencies and other business interruptions. Part of the plan must address backing up and storing data at a location sufficiently remote from the facilities at which the Contractor maintains State Data in case of the loss of State Data at the primary site. The Contractor’s backup solution must include plans to recover from an intentional deletion attempt by a remote attacker exploiting compromised administrator credentials.

The plan also must address the rapid restoration, relocation, or replacement of resources associated with the State Data in the case of a disaster or other business interruption. The Contractor’s business continuity plan must address short- and long-term restoration, relocation, or replacement of resources that will ensure the smooth continuation of operations related to the State Data. Such resources may include, among others, communications, supplies, transportation, space, power and environmental controls, documentation, people, data, software, and hardware.

4.7.7. For any remote access to State systems and networks by Contractor, Contractor must follow the State’s instructions for such access and employ secure data transmission protocols, including transport layer security (TLS) and public key authentication, signing and/or encryption. In addition, any remote access solution must use Secure Multipurpose Internet Mail Extensions (S/MIME) to provide encryption and non-repudiation services through digital certificates and the provided public key infrastructure (PKI).

Multifactor authentication must be employed for users with privileged network access by State-provided solutions.

Premises or Hybrid). If this section, or portions of this section, are not applicable, please explain and note as N/A. Please note that any proposed Compensating Controls and/or requirement modifications must be noted in Appendix A - Compensating Controls to Security and Privacy Requirements. The language within this Supplement will not be modified.

Our team will ensure secure access to any State data is restricted to only those working on all or portions of the project with explicit instructions not to pass or disseminate any State data or documents. Any and all access to the State network will follow State guidance.

1.8. Portable Devices and Media

Contractor must not allow State Data to be loaded onto portable computing devices or portable storage components or media unless necessary to perform its obligations under the Contract. If necessary for such performance, the Contractor may permit State Data to be loaded onto portable computing devices or portable storage components or media only if adequate security measures are in place to ensure the integrity and security of State Data. Those measures must include a policy on physical security and appropriate encryption for such devices to minimize the risk of theft and unauthorized access, as well as a prohibition against viewing sensitive or confidential data in public or common areas.

If it is necessary to load State Data onto portable computing devices or portable storage components or media, Contractor must ensure that portable computing devices have anti-virus software, personal firewalls, and system password protection. In addition, State Data must be encrypted when stored on any portable computing or storage device or media or when transmitted across any data network. Contractor must also maintain an accurate inventory of all such devices and the individuals to whom they are assigned.

Page | 12

The Contractor must have reporting requirements for lost or stolen portable computing devices authorized for use with State Data and must report any loss or theft of such devices to the State in writing as defined in Section 3.

Please explain how these requirements will be met within the context of the proposed solution (e.g., Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), On- Premises or Hybrid). If this section, or portions of this section, are not applicable, please explain and note as N/A. Please note that any proposed Compensating Controls and/or requirement modifications must be noted in Appendix A - Compensating Controls to Security and Privacy Requirements. The language within this Supplement will not be modified.

We will not load or copy any data or documents to portable devices or media. Any data requiring transit will be done so over secure, cloud-based document and data sharing technologies such as the State’s SharePoint solution.

2. State and Federal Regulatory Data Security and Privacy Requirements

The State is committed to protecting its information systems and the data it collects, processes, or maintains on behalf of itself or others from unauthorized use and disclosure, and uses the Fair Information Practice Principles (FIPPs) as the foundational principles for privacy policy and implementation. All systems and services must be designed and must function according to the FIPPs, which are transparency, individual participation, purpose specification, data minimization, use limitation, data quality and integrity, security, accountability, and auditing.

State systems include many different types of data that are protected by federal or state laws, rules, regulations, and policies, and may be amended from time to time. When the Contractor has knowledge, whether actual or implied, of the data classification of, or regulatory requirements applicable to, the State Data being utilized or accessed by the Contractor or in the Contractor’s services or systems, the Contractor is responsible for applying and complying with all such regulatory requirements applicable to that State Data. All systems and services must comply with the regulatory requirements set forth in this section and/or as otherwise communicated to the Contractor by the State, if applicable.

2.1. Applicable Regulatory Data Security and Privacy Requirements

The Contractor specifically agrees to comply with state and federal confidentiality and information disclosure laws, rules, and regulations applicable to the work associated with the Contract, including but not limited to:

2.1.1. United States Code 42 U.S.C. 1320d through 1320d-9 (HIPAA).

2.1.2. Code of Federal Regulations for Public Health and Public Welfare: 42 C.F.R. 431.300, 431.302, 431.305, 431.306, 435.945, 45 C.F.R. 164.502(e) and 164.504(e).

2.1.3. Ohio Revised Code sections 1347.01, 1347.04 through 1347.99, 2305.24, 2305.251, 3701.243, 3701.028, 4123.27, 5101.26, 5101.27, 5160.39, 5168.13, and 5165.88, as amended.

2.1.4. Ohio Administrative Code rules correspond to the Ohio Revised Code provisions in 2.1.3 above, as amended.

2.1.5. Systems and services must support and comply with the State’s security operational support model, which is aligned to NIST SP 800-53 (current, published version).

2.1.6. IRS Publication 1075, Tax Information Security Guidelines for federal, state, and local agencies, including the requirements set forth in Section 2.2.

Page | 13

2.1.7. The Law Enforcement Automated Data System (LEADS) Policy available at https://ohio.cjisapps.com/security/launchpad/cjisdocs/docs.cgi?cat_id=2 (incorporates the CJIS Security Policy).

Please explain how these requirements will be met within the context of the proposed solution (e.g., Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), On- Premises or Hybrid). If this section, or portions of this section, are not applicable, please explain and note as N/A. Please note that any proposed Compensating Controls and/or requirement modifications must be noted in Appendix A – Compensating Controls to Security and Privacy Requirements. The language within this Supplement will not be modified.

We will work closely with the State, on a case-by-case basis, to ensure the above requirements are met where applicable.

2.2. Federal Tax Information (FTI)

All computer systems receiving, processing, storing, or transmitting Federal Tax Information (FTI) must meet the requirements defined in Internal Revenue Service (IRS) Publication 1075. The language in this Section 2.2 may not be modified by Contractor and any proposed language changes listed in Contractor’s responses in this section or in Appendix A will not be considered. For purposes of this Section 2.2, “agency” means the applicable State entity.

2.2.1. IRS 1075 Performance Requirements

In the performance of the Contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

2.2.1.1. All work will be performed under the supervision of the Contractor.

2.2.1.2. The Contractor and Contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075. The Contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

2.2.1.3. FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this Contract. FTI in any format shall be treated as confidential and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this Contract. Inspection or disclosure of FTI to anyone other than the Contractor or the Contractor’s officers or employees authorized is prohibited.

2.2.1.4. FTI will be accounted for upon receipt and properly stored before, during, and after processing.

In addition, any related output and products require the same level of protection as required for the source material.

2.2.1.5. The Contractor will certify that FTI processed during the performance of this Contract will be completely purged from all physical and electronic data storage with no output to be retained by the Contractor at the time the work is completed. If immediate purging of physical and electronic data storage is not possible, the Contractor will certify that any FTI in physical or electronic storage will remain safeguarded to prevent unauthorized disclosures.

https://ohio.cjisapps.com/security/launchpad/cjisdocs/docs.cgi?cat_id=2

Page | 14

2.2.1.6. Any spoilage or any intermediate hard copy printout that may result during the processing of FTI will be given to the agency. When this is not possible, the Contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts and will provide the agency with a statement containing the date of destruction, description of material destroyed, and the destruction method.

2.2.1.7. All computer systems receiving, processing, storing, or transmitting FTI must meet the requirements in IRS Publication 1075. To meet functional and assurance requirements, the security features of the environment must provide for the managerial, operational, and technical controls. All security features must be available and activated to protect against unauthorized use of and access to FTI.

2.2.1.8. No work involving FTI furnished under this Contract will be subcontracted without the prior written approval of the IRS.

2.2.1.9. Contractor will ensure that the terms of FTI safeguards described herein are included, without modification, in any approved subcontract for work involving FTI.

2.2.1.10. To the extent the terms, provisions, duties, requirements, and obligations of this Contract apply to performing services with FTI, the Contractor shall assume toward the subcontractor all obligations, duties and responsibilities that the agency under this Contract assumes toward the Contractor, and the subcontractor shall assume toward the Contractor all the same obligations, duties and responsibilities which the Contractor assumes toward the agency under this Contract.

2.2.1.11. In addition to the subcontractor’s obligations and duties under an approved subcontract, the terms and conditions of this Contract apply to the subcontractor, and the subcontractor is bound and obligated to the Contractor hereunder by the same terms and conditions by which the Contractor is bound and obligated to the agency under this Contract.

2.2.1.12. For purposes of this Contract, the term “Contractor” includes any officer or employee of the Contractor with access to or who uses FTI, and the term “subcontractor” includes any officer or employee of the subcontractor with access to or who uses FTI.

2.2.1.13. The agency will have the right to void the Contract if the Contractor fails to meet the terms of FTI safeguards described herein.

2.2.1.14. Audit and accountability policies and procedures must be developed, documented, disseminated, and updated as necessary to facilitate implementing audit and accountability security controls of Contractor systems receiving, processing, storing or transmitting FTI.

a. To support the audit of activities, all agencies must ensure that audit information is archived for seven years.

b. The information system must protect audit information and audit tools from unauthorized access, modification, and deletion.

2.2.1.15. IRS Publication 1075 compliance is mandatory. The aforementioned compliance items are a small selection of key elements contained within the requirements defined in IRS publication 1075. The Contractor shall comply with all requirements of IRS Publication 1075 in its performance under the Contract. The parties may agree via amendment to the Contract to impose additional and more stringent requirements as deemed necessary to protect FTI.

Page | 15

Premises or Hybrid). If this section, or portions of this section, are not applicable, please explain and note as N/A. Please note that any proposed Compensating Controls and/or requirement modifications must be noted in Appendix A - Compensating Controls to Security and Privacy Requirements. The language within this Supplement will not be modified.

Because the proposed solution involves crash prediction and mitigation and vehicle incident and response technologies, there is no use for tax information to be included.

2.2.2. IRS 1075 Criminal/Civil Sanctions

2.2.2.1. Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that FTI disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any FTI for a purpose not authorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or imprisonment for as long as 5 years, or both, together with the costs of prosecution.

2.2.2.2. Each officer or employee of a contractor to whom FTI is or may be accessible shall be notified in writing that FTI accessible to such officer or employee may be accessed only for a purpose and to the extent authorized herein, and that access/inspection of FTI without an official need-to-know for a purpose not authorized herein constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or imprisonment for as long as 1 year, or both, together with the costs of prosecution.

2.2.2.3. Each officer or employee of a contractor to whom FTI is or may be disclosed shall be notified in writing that any such unauthorized access, inspection or disclosure of FTI may also result in an award of civil damages against the officer or employee in an amount equal to the sum of the greater of $1,000 for each unauthorized access, inspection, or disclosure, or the sum of actual damages sustained as a result of such unauthorized access, inspection, or disclosure, plus in the case of a willful unauthorized access, inspection, or disclosure or an unauthorized access/inspection or disclosure which is the result of gross negligence, punitive damages, plus the cost of the action. These penalties are prescribed by IRC sections 7213, 7213A and 7431 and set forth at 26 CFR 301.6103(n)-1.

2.2.2.4. Additionally, it is incumbent upon the contractor to inform its officers and employees of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a.

Specifically, 5 U.S.C. 552a(i)(1), which is made applicable to contractors by 5 U.S.C.

552a(m)(1), provides that any officer or employee of a contractor, who by virtue of his/her employment or official position, has possession of or access to agency records which contain individually identifiable information, the disclosure of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

2.2.2.5. Granting a contractor access to FTI must be preceded by certifying that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI. A contractor and each officer or employee must maintain their authorization to access FTI through annual recertification of their understanding of the agency’s security policy and procedures for safeguarding FTI. The initial certification and recertifications must be documented and placed in

Page | 16 the agency's files for review. As part of the certification and at least annually afterwards, a contractor and each officer or employee must be advised of the provisions of IRC sections 7213, 7213A, and 7431 (see Exhibit 4, Sanctions for Unauthorized Disclosure, and Exhibit 5, Civil Damages for Unauthorized Disclosure).