APPENDIX 6

Information Security Requirements and Questions

Instructions

[OPTION (INCLUDE THIS ATTACHMENT IF CONTRACTOR IS PROVIDING INFORMATION RESOURCES TO UNIVERSITY FOR UNIVERSITY’S USE. Pursuant to UT AUSTIN165 “Information Resources” means any and all computer printout Austin, online display devices, mass storage media, and all computer-related activities involving any device capable of receiving email, browsing Web sites, or otherwise capable of receiving, storing, managing, or transmitting Data including, but not limited to, mainframes, servers, Network Infrastructure, personal computers, notebook computers, hand-held computers, personal digital assistant (PDA), pagers, distributed processing systems, network attached and computer controlled medical and laboratory equipment (i.e. embedded technology), telecommunication resources, network environments, telephones, fax machines, printers and service bureaus. Additionally, it is the procedures, equipment, facilities, software, and Data that are designed, built, operated, and maintained to create, collect, record, process, store, retrieve, display, and transmit information.

ALSO INCLUDE THIS ATTACHMENT IF CONTRACTOR WILL ACCESS, CREATE, MAINTAIN AND OR TRANSMIT UNIVERSITY DATA. Pursuant to UT AUSTIN165, “Data” means recorded data, regardless of form or media in which it may be recorded, which constitute the original data necessary to support the business of UT System or original observations and methods of a study and the analyses of such original data that are necessary to support research activities and validate research findings. Data includes, but is not limited to: printed records, observations and notes; electronic data; video and audio records, photographs and negatives.) (After determining if it is necessary, remove highlighted sections).

INFORMATION SECURITY REQUIREMENTS AND QUESTIONS

UT Austin Information Security Requirements for Vendors

1. Multi-factor Authentication (MFA or also known as two-factor authentication-2FA), as defined by NIST SP 800-63, must be applied and enforced for all users on any information system that stores, transmits, or processes UT AUSTIN confidential data. See the UT AUSTIN Data Classification Guide and TXDIR Security Control Standards Catalog-IA-2(2) for the mandatory state requirements. Note: Two-step authentication or a one-time passcode (OTP) does not meet the MFA standard. Data Separation. Describe Proposer’s implementation strategy for segregating sensitive and non-sensitive data including: 1) How Proposer ensures different levels of protection mechanisms and security controls based on the University of Texas System Data Classification scheme; and 2) How Proposer integrates updated or new security controls specified by the University of Texas System.

2. Vendor provided or hosted information technology must use encryption standards approved by UT AUSTIN and defined in NIST SP 800-175B Rev. 1 for storing, transmitting, or processing confidential data owned by UT AUSTIN. This applies to applications (including mobile), websites, portals, and file transfers.

3. Required by Section 2054.517 of the Texas Government Code and defined in UT AUSTIN 165 Standard 11.8. Before deploying an Internet website (or portal) or mobile applications that process UT AUSTIN confidential information, the developer or third-party responsible for development must:

a. Submit the following documentation I. the architecture[endnoteRef:1] of the website and mobile applications; [1: Website architecture. A diagram and narrative of website logical structure, data flow, and design of the technical, security, functional, and visual components.]

II. the authentication mechanism(s) for the website and applications;

III. the Administrator level access to data included in or accessed by the website and applications;

b. Subject the website, portal and applications to a vulnerability and penetration test as described[endnoteRef:2]; this test must be repeated every year during the contract period. [2: Penetration and vulnerability test. Vendor may choose to either allow UT System to conduct a vulnerability scan on a test environment that mirrors the actual production environment or provide an attestation of a third-party vulnerability assessment. Review and acceptance of the findings shall comply with UT AUSTIN 165 Standard 10.8.]

c. Utilize approved access and authentication mechanisms[endnoteRef:3]. [3: Approved access and authentication mechanisms. Reference NIST 800-53B and UT AUSTIN 165 Standard 4: Access Management for approved standards. A unique identifier that does not include the individual’s social security number, in full or part per UT AUSTIN 165 Standard 13: Use and Protection of Social Security Numbers.

d. Apply two-factor authentication (2FA, also known as Multi-factor Authentication-MFA) for all administrator and user access.

If the vendor is responsible for credit card processing, the current version of PCI-DSS requirements must be met as defined by the PCI Security Standards Council (PCI SSC).

4. UT AUSTIN will conduct an annual security risk assessment for all systems that store, transmit, or process confidential data. Vendors will be requested to provide updated information for any system provided to UT AUSTIN, and sign an attestation to the security of those systems. Information and attestations may include, but not limited to: Certifications, Audit Reports, vulnerability scans, updated policies and the like. Note: Security and Privacy are components of an RFP Proposer selection and finalists must be prepared to have technical security and privacy experts available to answer questions prior to award of a contract.

Questions that apply to the vendor organization

1. Provide the name of the Chief Information Security Officer (CISO), Chief Information Officer (CIO) or equivalent positions along with a short description of his or her qualifications.

2. Are background checks and screening conducted on employees and subcontractors? If yes, what is the frequency?

3. Briefly explain how vendor’s security training is implemented for employees. (ex. HIPAA; Cyber Security; Phishing; Insider Threat; Remote Working; etc.)

4. Does the vendor have an established information security program based on an industry-standard framework? If yes, state the name of the framework and provide a description of the components, estimate of staff dedicated to the program, and how the vendor maintains up to date best practices such as patching, vulnerability scanning, incident response, risk management, etc.

5. Does a formal Security Operations Center (SOC) exist, either internally staffed or contracted to a third party? If yes, where is it (or if multiple, describe) geographically located? Does it operate on a 24x7x365 schedule?

6. Does the vendor have documented policies and procedures that cover the following:

a. Information Security

b. Security Incident Response and supporting procedures

c. Change Control and supporting procedures

d. Acceptable/Responsible Use

e. Privacy

f. Risk Management

g. Patch and Vulnerability Management

h. Cloud Security

i. Software Development Security

7. Provide the Table of Contents or an overview of the Security Incident Response Plan (IRP) and one example for each category: protection, detection, identification, and recovery.

8. How often are security and privacy policies updated?

Questions that apply to the vendor-proposed solutions for UT Austin

Data Security

1. Summarize the process for account provisioning and de-provisioning with regards to users that have access to UT AUSTIN (UT AUSTIN)-owned data.

2. Do the proposed services allow changes to UT AUSTIN data that isn’t tracked through audit logs?

3. List an example of an administrative safeguard or best practice employed to prevent unauthorized access to UT AUSTIN data.

4. Where will UT AUSTIN data be stored (answer all that apply):

a. In a physical (on-premise) data center, owned and/or managed by the vendor.

b. In third-party storage locations not managed by the vendor.

c. in Public or Private Cloud locations.

d. in a Cloud location outside of the United States.

e. Other (Please Explain)

5. If UT AUSTIN data will be stored in physical data center, what physical controls are in place? What level of redundancy tiering is the data center rated at?

6. Data Separation. Describe Proposer’s implementation strategy for segregating sensitive and non-sensitive data including: 1) How Proposer ensures different levels of protection mechanisms and security controls based on the University of Texas System Data Classification scheme; and 2) How Proposer integrates updated or new security controls specified by the University of Texas System.

7. Provide an example of how the vendor’s virtual systems are segregated and protected from risks.

8. If Cloud usage is proposed:

a. If yes, indicate which services and what type of hosting.

b. How will UT AUSTIN’s data be segregated from the data of other customers to prevent accidental or unauthorized access? (applies to all locations of data storage).

c. What Cloud security framework or industry standards are used to minimize risk to customer data, including accidental or deliberate exposure?

Identity and Access Management

1. UT AUSTIN requires two-factor authentication for all environments that store, transmit, or process UT AUSTIN confidential information. See Information Security Requirements for Vendors.

2. Does the vendor’s implementation of MFA meet the standards as defined by NIST SP 800-63 and will the provided technology meet these standards upon deployment?

3. Does vendor provide UT AUSTIN security assertion markup language (SAML) capabilities if required to integrate with UT AUSTIN Single Sign On (SSO) infrastructure that may include Shibboleth, Microsoft Entra, Okta, etc.? If SAML capabilities are limited, list those that can be accommodated.

4. Describe the Identity and Access Management (IAM) components of the vendor’s services.

5. Summarize how IAM components are kept in sync and how they integrate with each other.

6. How does the vendor’s platform ensure accurate and consistent secure identity management of all uniquely identified individuals?

7. How does the vendor detect account compromises? Provide two examples.

8. If an individual’s password is confirmed to be compromised, what is the process to reset/disable or otherwise protect UT AUSTIN data from exposure or malicious attacks?

Encryption

1. Explain the general encryption method in use for:

a. Data that’s stored, transmitted, and processed including that in a Session state.

b. Application data exchange and APIs including those that may have external connections or dependencies.

c. Database storage.

d. Data backups.

e. Mobile applications.

f. File transfers such as sFTP.

2. Describe how strong data encryption is applied to data at rest in all locations where Confidential information is stored.

3. Explain how cryptographic keys are managed, what protection mechanisms are in place, and who has access to them.

Vulnerability Management

1. Describe how all systems that store, transmit, process, or serve UT AUSTIN data to users are hardened.

2. Summarize the process for security patch management, including roles and responsibilities, frequency, testing plan and system maintenance.

3. Are periodic vulnerability scans performed? If yes:

a. How often are scans conducted?

b. What is the process to escalate and/or prioritize and remediate identified vulnerabilities?

c. Do scans include databases?

d. Are applications scanned to detect specific code related vulnerabilities prior moving to Production?

e. Are external scans done on a yearly basis? Are they conducted by a third party?

4. If UT AUSTIN discovers that a serious vulnerability exists in the vendor-supplied platform, describe the process for reporting, how and when the risk will be remediated.

Disaster Recovery and Business Continuity

1. Does the vendor have a Disaster Recovery Plan (DRP) that includes systems and services provided to customers, including UT AUSTIN? If so:

a. Is it supported by policies and procedures?

b. Is it updated periodically, If yes, how frequently?

c. If in place, provide an outline of the DRP.

d. Is it tested periodically? If yes, how frequently and what type of tests are performed?

e. Do all staff with a role or responsibility know about the DRP and how to access it in the case of a declared disaster?

f. If no DRP exists, describe the controls and methodology used to ensure the restoration and availability of UT AUSTIN data.

2. Is there a Business Continuity Plan (BCP) in place that ensures no, or minimal disruption of services provided to UT AUSTIN? If yes:

a. What is the maximum amount of time that services may be unavailable?

b. Provide an outline of the plan.

c. If not, provide a Service Level Agreement (SLA) and describe what alternative methods will be used to ensure the restoration and availability of UT AUSTIN data within a UT AUSTIN- agreed timeframe.

3. Explain how UT AUSTIN data is reliably destroyed upon request or under the terms of the contractual agreement? What evidence will be provided to System after data has been successfully destroyed?

Security Logging, Monitoring and Incident Response

1. Are adequate logs generated and stored to validate security controls are functioning as designed, including MFA requirements?

2. What is the average log retention period?

3. Are all systems configured to generate logs to a central storage location? If not, how is visibility into anomalous activity ensured?

4. Are logs generated any time a user accesses confidential information? (ex. PHI)

5. Summarize how multiple security logs and event data are correlated, analyzed and acted upon.

6. Provide an example of technology controls (e.g. DLP, firewall, IDS/IPS, Endpoint Detection, etc..) coupled with a process that is used to monitor the confidentiality, integrity and availability of the service proposed.

7. Provide two examples of a procedure in place to ensure timely mitigation of detected vulnerabilities and security incidents?

8. Is there a component of the vendor’s Incident Response Plan that addresses how the vendor will work with customers and subcontractors when a security or privacy incident involving UT AUSTIN data is detected?

9. How does the vendor detect a true positive security incident?

10. Will UT AUSTIN data be backed up and air gapped? If not, how will UT AUSTIN data be restored to its original state prior to a successful Ransomware attack?

11. How, and how quickly will the vendor notify UT AUSTIN of a successful attack or data exfiltration involving UT AUSTIN data? Who will be notified?

12. If Ransomware is discovered in the vendor’s systems that interact with the UT AUSTIN solution, what is the first step to mitigation?

13. Summarize the procedures in place to isolate or disable suspicious or compromised systems that interact with the service proposed.

14. When a significant incident that requires digital forensic investigation is declared, could UT AUSTIN data be retained for forensic purposes? If so, how will this affect business processes for UT AUSTIN?

15. Describe two examples of a method or process used to detect actions taken by an unauthorized entity attempting to access UT AUSTIN data, e.g., auto-generated audit reports or alerts.

16. Are there automated alerts or reports that monitor unauthorized access to UT AUSTIN confidential data? If yes, is the vendor willing to provide these to UT AUSTIN?

17. Are controls in place to detect precursor events to a Ransomware attack? If yes, describe these.

Policies and Procedures, Software Development

1. Is there a formal Change Management process for changes to UT AUSTIN-provided systems? How will UT AUSTIN be notified?

2. Are industry standards or a specific method/model followed for software development? If yes, what standard/model?

3. Are multiple, staged software development environments used for development, testing and production? If yes, describe how the environments are isolated from each other and what access controls are in place to minimize the risk of code corruption or unauthorized exposure.