6-HC Minimum IT Security Vendor Controls List.pdf

The document is the Harris County Minimum Information Technology Security Vendor Controls List, which establishes comprehensive cybersecurity requirements for vendors working with Harris County's technology systems. The document is divided into four main sections: Section 1 (All Vendors), Section 2A and 2B (Cloud Vendors), Section 3 (Custom Application Design Vendors), and Section 3 (Commercial Off The Shelf Software). Each section outlines specific security controls and artifacts that vendors must implement and provide, covering a wide range of technology services including software development, cloud computing, and off-the-shelf software solutions.

The vendor controls address critical security domains such as annual cybersecurity training, background checks, secure coding practices, multi-factor authentication, intrusion detection, and compliance with industry standards like NIST, HIPAA, PCI, and ISO27001. Vendors are required to submit various artifacts including SOC2 Type 2 Reports, penetration test reports, third-party attestations, certifications, and questionnaires. The controls are designed to protect sensitive data types including Personally Identifiable Information (PII), Payment Card Information (PCI), Protected Health Information (PHI), and Criminal Justice Information (CJI), with different requirements based on the vendor's specific technology service category and the sensitivity of the data being processed.