6-5. Exhibit C - Data and Cybersecurity Requirements.pdf
PDF 169 KB Posted
- Attached to
- Boulder County Public Health (BCPH) Electronic Health Record System with Medicaid Billing
- Solicitation number
- RFP-324-26
- Issued by
- Boulder County, Colorado
About this file
This file is Exhibit C of Boulder County's data and cybersecurity requirements document, which establishes mandatory security and compliance standards that contractors must adhere to when performing work for Boulder County, Colorado. The exhibit does not specify particular products or services, response dates, due dates, site visits, bidder meetings, award dates, or contract terms. Instead, it functions as a comprehensive attachment to procurement documents that applies to any contractor engaging with the County, establishing baseline security and data protection obligations across all County business relationships.
The requirements outlined in the document address multiple regulatory frameworks and security domains applicable based on the contractor's access to specific data types or systems. Contractors may be subject to compliance with Colorado privacy statutes for personal identifying and personal information; Payment Card Industry Data Security Standard (PCI-DSS) for payment card-related work; FBI Criminal Justice Information Systems (CJIS) Security Policy for background check data; Health Insurance Portability and Accountability Act (HIPAA) requirements for protected health information; Children's Online Privacy Protection Act (COPPA) standards for information on children under thirteen; and Title 45 CFR Parts 302, 303, and 307 for federal tax information. All contractors with access to County data must implement encryption in transit and at rest, access controls, logging, and least privilege principles, with multi-tenant solutions required to enforce strong data separation. Contractors providing hosted information technology services must provide security attestations such as SOC2 Type 1 reports and maintain incident response practices. Additionally, contractors must securely delete County data within ninety days of contract termination or as required by law, report any exposure of access control mechanisms within three business days, and reimburse the County for expenses arising from security breaches, with contractors required to notify the County immediately upon discovery of any compromise to personally identifiable or personal information at their expense.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Rev. 1/25
EXHIBIT C: Boulder County Data and Cyber Security Requirements
Boulder County (County) requires that its business partners comply with the County’s data and cyber security standards while under contract with the County. Contractor shall comply with the following requirements:
Personal Identifying Information and Personal Information Responsibilities
Contractors with access to personal identifying information (PII) or personal information (PI) of Colorado residents, including County employees, or County systems with access to that data shall implement and maintain security, consent, and marketing procedures and practices to protect that data in accordance with Colorado privacy statutes, C.R.S. § 24-73-101 et seq. Contractor must be willing to attest that it is compliant with Colorado privacy statutes.
Legal requirements may differ based on the agreed-upon work (“Products and Services”) to be performed.
Purchasing Card Industry (PCI) Compliance Contractors that perform work related to purchasing cards shall deliver Products and Services to the County in strict compliance with the Payment Card Industry Data Security Standard (PCI-DSS). The design and standard implementation of the Products and Services must not result in the need for the County to implement compensating controls to maintain the County’s compliance with the PCI-DSS. Contractors executing payment processing services on behalf of the County must provide County with access to documentation of its Purchasing Card Industry Data Security Standard Attestation of Compliance (PCI-DSS-AOC).
Criminal Justice Information Systems (CJIS) Contractors with access to state or federally derived background check data or County systems with such access agree to deliver Products and Services that strictly comply with the FBI’s CJIS Security Policy. Without limiting Contractor’s obligations hereunder, Contractor agrees to cooperate with County procedures for CJIS compliance that may include, but are not necessarily limited to, background checks and fingerprinting. Contractor is responsible for all CJIS compliance requirements.
Health Insurance Portability and Accountability Act (HIPAA) Contractors that require access to Protected Health Information (PHI) or County systems that contain PHI shall enter into a HIPAA Business Associate Agreement with Boulder County prior to obtaining the necessary access.
Children's Online Privacy Protection Act (COPPA) Contractors with access to PI about any child(ren) under the age of thirteen (13) or County systems that contain such data shall implement and maintain security, consent, and marketing procedures and practices in accordance Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq. See 15 U.S.C. § 6501(8).
Hosted Information Technology Services (Software, Data, or Infrastructure) Contractors providing hosted information technology services for the County shall provide documentation attesting to their reasonable security procedures, as well as any non-confidential specific industry attestation (such as a SOC2 Type 1 report) documentation. Contractors providing hosted information technology services agree to maintain an incident response practice to protect hosted County resources.
Data Confidentiality and Integrity Contractors who host or have access to County data shall control for the integrity and confidentiality of that data by implementing logging, access control, least privilege, encryption in transit, and encryption at rest. Any multi-tenant solution shall enforce the strong separation of County data and systems from those of other customers.
Contractors agree to securely delete all County data within their environment within 90 days after the termination of the parties’ agreement or the retention period required by law, whichever is longer. Contractors with access to County access control or authenticity mechanisms (passwords, encryption keys, certificates, or application program interface (API) keys) or who generate them on behalf of the County must implement reasonable security practices to protect the confidentiality of that data. Exposure of a County access control or authenticity mechanism must be reported to the County within three (3) business days.
If Contractor becomes aware that the security of any PII or PI may have been compromised, Contractor will, at its expense: (i) notify County in writing of the occurrence immediately; (ii) address the cause of the occurrence to the extent practicable (iii) cooperate with County’s efforts to respond to the occurrence, including sharing with County information relevant to the occurrence; and (iv) reimburse the County for expenses incurred due to the occurrence.
Remote Access to County Resources
Contractors seeking external access to the County’s technology resources must enter into a separate Connected Partner Agreement with Boulder County prior to obtaining such access.
Federal Tax Information
Contractors with access to Federal Tax Information (FTI) or County systems that contain FTI data agree to deliver Products and Services that strictly comply with Title 45 Code of Federal Regulations (CFR), Parts 302, 303, 307.
File details come from the government source that posted it. Updated .