6-HC Minimum IT Security Vendor Controls List.pdf

This is a Minimum IT Security Vendor Controls List document for Harris County, Texas, establishing baseline security requirements for vendors supporting the Class D Pharmacy Inventory Management Program (CDP-IMP) for Harris County Public Health Services. The document outlines mandatory IT security standards that all potential vendors must meet to qualify for participation in the pharmacy inventory management system beginning approximately July 1, 2026. The controls list serves as a prerequisite evaluation criterion for vendor selection, ensuring that all IT infrastructure, data protection, and security protocols align with Harris County's minimum acceptable standards for handling sensitive pharmacy and health services data.

The vendor controls requirements encompass critical security domains including access controls, data protection, encryption standards, system monitoring, incident response procedures, business continuity planning, and compliance with healthcare data security regulations. Vendors must demonstrate compliance with these minimum controls as part of their proposal submission and qualification process. The controls list functions as a mandatory technical specification rather than a negotiable element, establishing a baseline security posture that protects the county's pharmacy operations and patient information throughout the contract term. Non-compliance with these minimum IT security standards is grounds for vendor disqualification from the procurement process.