About this file
This is an Information Security Review document prepared for the Texas Education Agency (TEA) in support of the OneSystem contract opportunity. The document outlines the security assessment and requirements for the proposed centralized digital platform designed to replace TEA's fragmented grant management and performance management systems. The review evaluates the security posture, vulnerabilities, and risk mitigation strategies necessary for implementing and maintaining OneSystem as a mission-critical system. The security review encompasses system architecture, data protection measures, access controls, and compliance requirements to ensure the platform meets state and federal security standards for handling sensitive educational and financial data.
The Information Security Review identifies critical security controls, authentication protocols, encryption standards, and incident response procedures required for OneSystem's design, development, and ongoing operations. The document establishes baseline security requirements that respondents must address in their technical proposals and implementation plans. Key focus areas include protection of personally identifiable information (PII), compliance with Texas information security standards, network security architecture, vulnerability management, audit logging, and disaster recovery capabilities. The review serves as a technical specification document to guide qualified respondents in developing secure solutions that protect TEA's data assets while supporting the agency's operational objectives for grant management and performance monitoring across the Texas education system.
View the file
Other files
Show all 20
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ATTACHMENT H: INFORMATION SECURITY REVIEW
Contractors must include this completed form with their response. Providing sufficiently detailed responses and confirmation to the following questions will allow TEA to accurately assess and mitigate risk to TEA data.
Question Number:
Question Contractor Response to Question
1. How will the contractor ensure that TEA Confidential Information will be encrypted at rest and in motion?
2. Will the contractor process all TEA Confidential Information solely within the contiguous United States? If you answered ‘No’ to this question, please explain.
3. How will the contractor ensure that access to TEA Confidential Information will be limited to employees, and subcontractors who have passed reasonable security clearance checks?
4. What physical security and access controls does the contractor implement at its facilities (including any data centers) that house TEA Confidential Information?
5. Which authentication methods are leveraged on systems that will house TEA Confidential Information? (i.e., Multi-Factor Authentication (MFA), Privileged Access Management (PAM), and/or 14-character minimum passphrases)
6. Is Endpoint Detection and Response (EDR) technology enabled on systems that will store, process, or transmit TEA Confidential Information? If not, please provide explanation of protection of the data on the systems from malware.
7. What is the contractor’s established vulnerability and patch management program?
8. Describe how backups of data are stored and maintained. Are the backups stored on a separate network from production?
9. Which Cybersecurity Framework is the contractor’s Cybersecurity program based on?
10. Is cybersecurity awareness training taken annually by employees and subcontractor employees that will have access to TEA Confidential Information? Is the training certified by Texas Department of Information Resources? If not, please provide details about the cybersecurity awareness training program including cadence and source.
11. Provide evidence of any third-party cybersecurity certifications such as ISO27001 or SOC2 reports, and any gap year assessments or change of scope documentation.
https://dir.texas.gov/information-security/certified-training-programs https://dir.texas.gov/information-security/certified-training-programs
12. Provide the executive summary of the most recent Penetration Test or Risk Assessment of the customer facing application(s).
13. What changes will be made in the next 18 months that may impact the security of data stored in this environment?
14. Provide your data sanitization and destruction policy.
File details come from the government source that posted it. Updated .