7-Attachment D Cyber Security Requirements.pdf

Cyber Security Requirements - 2026V1.5

CONTENTS

Cyber Security Requirements

Purpose

Non-Disclosure Agreements

Requirements Introduction

Scope

Definitions

Requirements

1. Information Security Governance

2. Data Protection Requirements

3. Authentication and Access Control

4. Network and Application Security

5. Audit Logging and Monitoring

6. Incident Response and Breach Notification

7. Business Continuity and Disaster Recovery

8. Third-Party / Sub-Processor Management

9. Data Retention and Destruction

10. Compliance Documentation and Verification

11. Privacy, Legal and Regulatory

12. Right to Audit & Continuous Compliance

13. AI/ML & Automated Decision-Making

Revision History

CYBER SECURITY REQUIREMENTS

PURPOSE

This Cyber Security Requirements document defines the minimum standards that all Offerors must meet when providing any products, solutions, or services that include any form of technology, whether hardware, software, cloud‑based, digital, network‑connected, or electronically managed, to the County. These standards are essential for evaluating vendor security and establishing the necessary controls to protect County data and infrastructure.

The specific standards that apply to each engagement will depend on the nature and risk profile of the product.

If a vendor cannot meet these minimum standards, exceptions may be considered during the selection process.

Before contracts are awarded, selected vendors must complete the County's security questionnaires to demonstrate compliance with these requirements.

The County recognizes that unique circumstances may arise, and requests for exceptions to these standards will be assessed based on existing security measures and the proposed solutions to ensure overall compliance and security.

NON-DISCLOSURE AGREEMENTS

County Employees are not allowed to sign Non-Disclosure Agreements. The County recognizes vendors’ concerns about sharing sensitive information. While public records law limits our ability to contractually waive public access obligations, we fully support confidentiality where statutory exemptions apply. This means that the records meeting these exemptions are legally required to be kept confidential by the County, regardless of the existence of any non-disclosure agreement. (Please refer to document - Treatment of Confidential Records)

REQUIREMENTS INTRODUCTION

Contractor shall implement and maintain a comprehensive cybersecurity program that ensures the confidentiality, integrity, and availability of all data, system interactions, access credentials, and services provided under this Contract. The Contractor’s cybersecurity program shall comply with all applicable federal, state, and local regulations, including but not limited to Florida’s cybersecurity requirements for local government entities, and shall align with recognized industry standards.

These requirements listed herein govern in the event of any conflict with Contractor’s security description, acceptable use policy, privacy policy, data processing addendum, or any other terms of the agreement.

If there is a conflict between these Requirements and the County’s general terms and conditions, these more stringent requirements shall apply

SCOPE

This applies to all digital and network-connected, and electronically managed systems across the organization. It includes devices that store, process, transmit, monitor, or control data or physical processes.

• All hardware, software, and firmware components

• Cloud-connected and on-premises systems

• Mobile, remote, and distributed architectures

• Any system affecting confidentiality, integrity, availability, safety, or operational continuity

No system is excluded based on ownership, location, or criticality. Legacy systems that cannot be upgraded or replaced remain in scope and require compensating controls.

DEFINITIONS

• County Data: Any data provided by, generated for, or collected on behalf of the County under this Contract, including Confidential Information.

• Confidential Information (CI): Information classified by the County as confidential or restricted, including but not limited to PII, PHI, PCI data, credentials, keys, and system configuration details.

• Covered Systems: Any information systems, devices, applications, or cloud services that store, process, transmit, or otherwise interact with the County data.

• Security Incident: A confirmed or suspected event that compromises—or could reasonably compromise— the confidentiality, integrity, or availability of County Data or Covered Systems (e.g., unauthorized access, malware/ransomware, data exfiltration, or material service disruption; including compromise of Contractor credentials capable of accessing County systems).

• Sub-processor: Any third party engaged by the Contractor to fulfill contract obligations, including cloud service providers, MSPs, and software vendors.

REQUIREMENTS

1. INFORMATION SECURITY GOVERNANCE

1.1 The Contractor shall maintain a documented information security program aligned to:

• CIS Critical Security Controls (v8)

• NIST AI RMF, NIST AI 100-1 AI Risk Governance

• NIST Cybersecurity Framework (NIST CSF)

• NIST Privacy Framework

• NIST SP 800-171 CUI Protection

• NIST SP 800-82 OT/SCADA & Critical Infrastructure

• NIST Special Publication 800-53 v5 (Moderate Baseline or equivalent)

• Other NIST publications as appropriate

• OWASP Standards

1.2 The Contractor shall appoint a qualified Information Security Officer, whose name shall be provided, to oversee security controls, manage security operations, handle incident response, and ensure audit compliance. Additionally, the Information Security Officer should ensure that relevant information is effectively communicated to all stakeholders.

1.3 All Contractor personnel with access to County data or systems shall undergo background checks in accordance with applicable laws and County requirements.

1.4 The Contractor shall maintain controls aligned to OWASP Top 10 and OWASP ASVS throughout the contract term. The Contractor shall demonstrate that the application, API, or solution follows OWASP-recommended security practices.

1.5 Cloud/SaaS delivering Controlled or Confidential data shall demonstrate conformance equivalent to SOC 2

Type II within the past 12 months.

1.6 The Contractor should not disable, downgrade, or remove mandated security controls without prior written approval from the County.

2. DATA PROTECTION REQUIREMENTS

2.1 The Contractor shall encrypt all cryptography and key management data.

• In transit using TLS 1.2 or higher with modern cipher suites; enforce HSTS (HTTP Strict Transport Security) where the web is exposed.

• At rest: AES 256 (or equivalent FIPS 140-3 validated) for Confidential Information (CI) within databases, object storage, and backups, and ephemeral storage (temporary files, downloads, caches, and logs containing sensitive information).

• Key & Secrets Management: Segregated KMS; role-based key access; periodic key rotation (≤ 12 months);

hardware-backed (HSM) or cloud KMS using Customer Managed Keys for CI; no plaintext secrets in code, repos, or tickets; vault and audit all secret access.

2.2 The Contractor shall implement controls including:

• Data segregation in multi-tenant environments.

• Least Privilege/Role-Based Access Control (RBAC).

• Documented access provisioning and deprovisioning workflows.

2.3 The Contractor shall disclose all data storage, processing, and backup locations. No data may be stored, processed, or routed outside the United States without prior written approval.

2.4 The Contractor shall minimize data collection and ensure only necessary information is stored. Collect and retain only what is strictly necessary for the contracted services; do not use County Data for product improvement, analytics, marketing, AI/ML training, or cross‑customer enrichment without prior written approval.

2.5 All temporary files, report downloads, cached data, and logs containing sensitive information shall be encrypted.

2.6 Privacy Rights & Transparency: Contractor shall support the County in fulfilling data subject rights and regulatory obligations (e.g., access, correction, deletion), provide clear notices of data use, and maintain records of processing activities for County Data

2.7 DPIA: Where processing presents heightened privacy risk (e.g., identity verification, credit risk scoring, automated decision‑making), Contractor shall support a Data Protection Impact Assessment and implement mitigating controls approved by the County.

2.8 Third‑Party Requests: Contractor shall promptly notify the County of any legal, regulatory, or third‑party request for County Data and shall not disclose County Data without written County direction.

3. AUTHENTICATION AND ACCESS CONTROL

3.1 All System access shall use unique, non-shared accounts; universal passwords are prohibited.

3.2 Multi-factor authentication (MFA) is required for:

• All Certificate Signing Request (CSR) access

• Administrative access

• Contractor support access

3.3 Password and PIN requirements shall include:

• Minimum length and complexity

• Rotation and expiration

• Reuse prevention

3.4 The System shall enforce automatic session timeout and account lockout following failed authentication attempts.

3.5 Privileged access shall follow the principles of least privilege and just-in-time access where feasible.

3.6 Joiner/Move/Leaver: Provisioning/deprovisioning SLAs ≤ 24 hours; disable stale accounts; remove shared admin credentials.

3.7 Endpoint Controls: EDR with behavioral detection on all Covered Systems; disk encryption; device compliance; secure baseline hardening aligned with CIS Benchmarks.

3.8 Contractor shall provide SSO/SAML/OIDC support

4. NETWORK AND APPLICATION SECURITY

4.1 The Contractor shall provide a secure, modern web-based System that:

• Enforces HTTPS using approved protocols (TLS 1.2 or higher, no deprecated cipher suites)

• Protects against credential-stuffing, brute-force, and automated attacks

4.2 The Contractor shall implement secure software development practices and maintain updated documentation of System architecture, data flows, and security design.

4.3 The Contractor shall conduct:

• Continuous vulnerability scanning

• Independent annual penetration testing

• Patch management with timelines (critical patches within 15 days)

• Restrict use of outdated frameworks

4.4 All third-party libraries and dependencies shall be monitored for vulnerabilities.

5. AUDIT LOGGING AND MONITORING

5.1 The Contractor shall maintain complete, tamper-resistant audit logs for:

• Successful and failed logins

• All data access events

• Administrative actions, including PIN creation/deactivation

5.2 Logs shall be retained based on business, legal, and regulatory requirements.

5.3 Logs shall include timestamps synchronized via NTP and sufficient detail for forensic review.

5.4 Contractor shall support County audits of logging and cybersecurity controls upon request.

5.5 Integration: (as appropriate) Provide APIs or forwarding to the County SIEM/SOC; time synchronization (NTP) across systems

6. INCIDENT RESPONSE AND BREACH NOTIFICATION

6.1 The Contractor shall maintain a documented incident response plan covering detection, containment, eradication, recovery, and post-incident review.

6.2 Contractor shall notify Hillsborough County of any suspected or confirmed security incident affecting County data or System credentials:

• Within 24 hours of detection for suspected compromise

• Immediately for confirmed breaches

6.3 Contractor shall fully cooperate with County investigations and third-party forensic examiners.

6.4 Contractor shall provide a written root-cause analysis and corrective action plan within ten (10) business days following incident closure.

6.5 Cooperation: Support forensics, containment, eradication, and recovery; preserve relevant logs; do not impede investigations.

7. BUSINESS CONTINUITY AND DISASTER RECOVERY

7.1 The Contractor shall maintain BC/DR plans that include:

• Documented RTO and RPO

• Encrypted backups stored in the United States

• Annual BC/DR testing

7.2 The System shall maintain 24/7 availability except for approved scheduled maintenance.

7.3 Test results and remediation plans shall be provided to the County upon request.

8. THIRD-PARTY / SUB-PROCESSOR MANAGEMENT

8.1 The Contractor shall disclose all Subcontractors and Sub-processors with access to County data.

8.2 The Contractor shall ensure all Sub-processors comply with the cybersecurity requirements of this Contract.

8.3 No new Subcontractor may be added without prior written County approval.

8.4 Sub-processors shall store and process data only within the United States unless otherwise approved in writing.

8.5 Due Diligence: Conduct security assessments of Subcontractors; maintain a vetted list; notify the County prior to onboarding.

8.6 Supply Chain Security: Maintain tamper-evident processes; verify the integrity of software artifacts; monitor for compromised dependencies.

9. DATA RETENTION AND DESTRUCTION

9.1 The Contractor shall implement retention schedules for:

• Inquiry records

• Identity status responses

• Credit rating responses

9.2 Destruction shall comply with NIST SP 800‑88; provide a Certificate of Destruction upon contract termination or County request; delete all County Data within 30 days of a written deletion request unless legally prohibited.

9.3 Upon contract termination or at the County’s request, Contractor shall provide a Certificate of Destruction.

10. COMPLIANCE DOCUMENTATION AND VERIFICATION

10.1 Contractor shall provide evidence of compliance, including (if available):

• SOC 2 Type II reports

• Independent penetration testing summaries

10.2 The Contractor shall complete all applicable County cybersecurity questionnaires and participate in all mandated reviews. The number of security forms needed depends on the risk and set-up of the proposed solution. Contractors might have to fill out several forms depending on where and what technology is used. These forms help check how well the Contractor meets County standards.

10.3 Failure to demonstrate compliance may result in proposal rejection or contract termination or may result in withholding of compensation until deficiency is corrected.

10.4 Any material misrepresentation in Hillsborough County Certification of AI Alignment or Questionnaires shall constitute an immediate event of contract default.

11. PRIVACY, LEGAL AND REGULATORY

11.1 Where applicable, Contractor shall comply with relevant privacy laws and sector regulations (e.g., HIPAA, FERPA, CJIS, PCI DSS, CIS, EPA, Florida DEP). Contractors shall support Data Subject Requests, assessment and regulatory audits as required by the County.

12. RIGHT TO AUDIT & CONTINUOUS COMPLIANCE

12.1 The County reserves the right to audit Contractor’s security controls (reasonable notice) and to require independent assessments. Contractor shall provide periodic attestation (annually) of continued compliance and notify the County within 5 business days of material changes affecting security posture. The Contractor shall notify the County within five (5) business days of material changes affecting security posture (e.g., hosting region changes, control downgrades, new Sub-processors)

13. AI/ML & AUTOMATED DECISION -MAKING

Organizations that utilize Artificial Intelligence are required to complete the Hillsborough County Certification of

AI Alignment along with their submitted proposals. This certification ensures that they adhere to essential AI requirements, focusing on aspects such as usage, transparency, fairness, and accuracy.

13.1 Data Usage & Model Training

• Prohibition: The Contractor and its Sub-processors shall not use County Data (including prompts, inputs, outputs, or metadata) to train, fine-tune, or evaluate foundational AI/ML models without prior written approval from the County.

• Isolation: The Contractor shall certify that County Data is strictly isolated from the Contractor’s general training corpus and other customers’ data.

13.2 Transparency

• Bot Disclosure: If the system utilizes a public-facing chatbot or synthetic media, the Contractor shall implement automated disclosures notifying users of AI interaction at the start of every session.

• Documentation: The Contractor shall provide Transparency or Model Cards detailing the model’s training data origins, known limitations, and bias testing results.

• Traceability: The Contractor shall maintain a versioning log of all AI models used. The County shall be notified within 60 days of any significant underlying model updates.

13.3 Safety, Fairness, & Accuracy

• Guardrails: Contractor shall implement guardrails to prevent data leakage (e.g., content filters, redaction, access controls)

• Disable Requirement: For high-risk applications (as determined by the County), the Contractor shall provide a manual override or Killswitch allowing the County to instantly disable AI features without impacting core system functionality.

• Bias Mitigation: The Contractor shall provide evidence of regular audits for fairness and accuracy. and provide citation to the source data for every output.

• Human-in-the-loop: The system shall support a human review workflow. The County reserves the right to mandate a minimum sampling rate for manual verification of AI outputs.

13.4 Adversarial Defense (AI Security)

• Threat Protection: The Contractor shall implement controls aligned with the OWASP Top 10 for LLM Applications, specifically protecting against prompt injection, data poisoning, and sensitive information disclosure.

• Red-Teaming: The Contractor shall conduct annual Red-Teaming exercises for AI-specific vulnerabilities and provide an executive summary of findings to the County.

13.5 Data Residency & Sub-processors

• Domestic Processing: All AI processing and inference (including third-party API calls) shall occur within the United States for data classified as Restricted or Confidential, unless a written exception is granted.

• DPA Requirement: The Contractor shall provide the Data Processing Addendum (DPA) between the Contractor and any third-party AI provider (e.g., OpenAI, Microsoft Azure AI) to ensure alignment with County privacy standards.

REVISION HISTORY

Version ID Date of Change Author Section/Page Revision

2026V1.5 07/15/2026 CSS/Data/Procurement Various Terms and process changes – Final Published 08/01/26