9-Attachment AA - HC Minimum IT Security Vendor Controls List.pdf

The document is the Harris County Minimum Information Technology Security Vendor Controls List, which establishes comprehensive cybersecurity requirements for vendors working with Harris County's technological infrastructure. The document is divided into four primary sections covering different types of vendors: All Vendors, Cloud Vendors (Software as a Service), Custom Application Design Vendors, and Commercial Off The Shelf Software providers. Each section outlines specific technological security controls and artifacts that vendors must comply with when developing, hosting, or supporting Harris County IT solutions.

The controls encompass a wide range of cybersecurity measures, including mandatory annual cybersecurity training, background checks, secure coding practices, multi-factor authentication, intrusion detection systems, and compliance with industry standards such as NIST, HIPAA, PCI, and ISO27001. Vendors must provide various artifacts like SOC2 Type 2 Reports, penetration test reports, third-party attestations, and complete detailed questionnaires about their security practices. The document emphasizes protecting sensitive data types including Personally Identifiable Information (PII), Payment Card Information (PCI), Protected Health Information (PHI), and Criminal Justice Information (CJI), with more stringent requirements for vendors handling confidential or business-critical data.