9-RFP-26-00364 Attachment A - Cybersecurity Requirements.pdf

Cyber Security Requirements - 2026V1.3

Contents Cybersecurity Requirements

Purpose

Requirements Introduction

Definitions

1. Information Security Governance

2. Data Protection Requirements

3. Authentication and Access Control

4. Network and Application Security

5. Audit Logging and Monitoring

6. Incident Response and Breach Notification

7. Business Continuity and Disaster Recovery

8. Third-Party / Sub-Processor Management

9. Data Retention and Destruction

10. Compliance Documentation and Verification

11. Privacy, Legal and Regulatory

12. Cyber Insurance & Liability

13. Right to Audit & Continuous Compliance

14. AI/ML & Automated Decision-Making

Cybersecurity Requirements Revision History

Cybersecurity Requirements

Purpose This Cyber Security Requirements document is provided as mandatory guidance for all bidders and proposers responding to County solicitations. It outlines the minimum-security standards, controls, and expectations that must be met by any vendor seeking to provide products or services involving County data, systems, or infrastructure. These requirements establish the baseline safeguards necessary to ensure the confidentiality, integrity, and availability of County information and to uphold the County’s regulatory, privacy, and risk‑management obligations. All bidders, proposers, and vendors are expected to review, understand, and demonstrate compliance with these standards as part of the procurement and contracting process.

Requirements Introduction Vendor shall implement and maintain a comprehensive cybersecurity program that ensures the confidentiality, integrity, and availability of all data, system interactions, access credentials, and services provided under this Contract. The Vendor’s cybersecurity program shall comply with all applicable federal, state, and local regulations, including but not limited to Florida’s cybersecurity requirements for local government entities, and shall align with recognized industry standards.

These requirements listed herein govern in the event of any conflict with vendor’s security description, acceptable use policy, privacy policy, data processing addendum, or any other terms of the agreement.

If there is a conflict between these Requirements and the county’s general terms and conditions, these more stringent requirements shall apply

Definitions

• County: Hillsborough County, a political subdivision of the State of Florida.

• County Data: Any data provided by, generated for, or collected on behalf of the County under this Contract, including Confidential Information.

• Confidential Information (CI): Information classified by the county as confidential or restricted, including but not limited to PII, PHI, PCI data, credentials, keys, and system configuration details.

• Covered Systems: Any information systems, devices, applications, or cloud services that store, process, transmit, or otherwise interact with the county data.

• Security Incident: A confirmed or suspected event that compromises—or could reasonably compromise—the confidentiality, integrity, or availability of county Data or Covered Systems (e.g., unauthorized access, malware/ransomware, data exfiltration, or material service disruption; including compromise of Vendor credentials capable of accessing county systems).

• Sub-processor / Sub-contractor: Any third party engaged by the Vendor to fulfill contract obligations, including cloud service providers, MSPs, and software vendors.

1. Information Security Governance

1.1 The Vendor shall maintain a documented information security program aligned to:

• NIST Cybersecurity Framework (NIST CSF)

• NIST Special Publication 800-53 v5 (Moderate Baseline or equivalent)

• CIS Critical Security Controls (v8)

• OWASP Standards

1.2 The Vendor shall appoint a qualified Information Security Officer, whose name must be provided, to oversee security controls, manage security operations, handle incident response, and ensure audit compliance. Additionally, the Information Security Officer shall ensure that relevant information is effectively communicated to all stakeholders.

1.3 All Vendor personnel with access to county data or systems shall undergo background checks in accordance with applicable laws and county requirements.

1.4 The vendor must maintain controls aligned to OWASP Top 10 and OWASP ASVS throughout the contract term. The vendor must demonstrate that the application, API, or solution follows OWASP-recommended security practices.

1.5 Cloud/SaaS delivering Controlled or Confidential data shall demonstrate conformance equivalent to SOC

2 Type II within the past 12 months.

1.6 The Vendor should not disable, downgrade, or remove mandated security controls without prior written approval from the county.

2. Data Protection Requirements

2.1 The Vendor must encrypt all cryptography and key management data.

• In transit using TLS 1.2 or higher with modern cipher suites; enforce HSTS (HTTP Strict Transport Security) where the web is exposed.

• At rest: AES 256 (or equivalent FIPS 140-3 validated) for Confidential Information (CI) within databases, object storage, and backups, and ephemeral storage (temporary files, downloads, caches, and logs containing sensitive information).

• Key & Secrets Management: Segregated KMS; role-based key access; periodic key rotation (≤ 12 months); hardware-backed (HSM) or cloud KMS using Customer Managed Keys for CI; no plaintext secrets in code, repos, or tickets; vault and audit all secret access.

2.2 The Vendor shall implement controls including:

• Data segregation in multi-tenant environments.

• Least Privilege/Role-Based Access Control (RBAC).

• Documented access provisioning and deprovisioning workflows.

2.3 The Vendor shall disclose all data storage, processing, and backup locations. No data may be stored, processed, or routed outside the United States without prior written approval.

2.4 The Vendor shall minimize data collection and ensure only necessary information is stored. Collect and retain only what is strictly necessary for the contracted services; do not use county Data for product improvement, analytics, marketing, AI/ML training, or cross‑customer enrichment without prior written approval.

2.5 All temporary files, report downloads, cached data, and logs containing sensitive information must be encrypted.

2.6 Privacy Rights & Transparency: Vendor shall support the county in fulfilling data subject rights and regulatory obligations (e.g., access, correction, deletion), provide clear notices of data use, and maintain records of processing activities for county Data

2.7 DPIA: Where processing presents heightened privacy risk (e.g., identity verification, credit risk scoring, automated decision‑making), Vendor shall support a Data Protection Impact Assessment and implement mitigating controls approved by the county.

2.8 Third‑Party Requests: Vendor shall promptly notify the county of any legal, regulatory, or third‑party request for county Data and shall not disclose county Data without written county direction.

3. Authentication and Access Control

3.1 All System access shall use unique, non-shared accounts; universal passwords are prohibited.

3.2 Multi-factor authentication (MFA) is required for:

• All Certificate Signing Request (CSR) access

• Administrative access

• Vendor support access

3.3 Password and PIN requirements shall include:

• Minimum length and complexity

• Rotation and expiration

• Reuse prevention

3.4 The System shall enforce automatic session timeout and account lockout following failed authentication attempts.

3.5 Privileged access shall follow the principles of least privilege and just-in-time access where feasible.

3.6 Joiner/Move/Leaver: Provisioning/deprovisioning SLAs ≤ 24 hours; disable stale accounts; remove shared admin credentials.

3.7 Endpoint Controls: EDR with behavioral detection on all Covered Systems; disk encryption; device compliance; secure baseline hardening aligned with CIS Benchmarks.

3.8 Vendor shall provide SSO/SAML/OIDC support

4. Network and Application Security

4.1 The Vendor shall provide a secure, modern web-based System that:

• Enforces HTTPS using approved protocols (TLS 1.2 or higher, no deprecated cipher suites)

• Protects against credential-stuffing, brute-force, and automated attacks

4.2 The Vendor shall implement secure software development practices and maintain updated documentation of System architecture, data flows, and security design.

4.3 The Vendor shall conduct:

• Continuous vulnerability scanning

• Independent annual penetration testing

• Patch management with timelines (critical patches within 15 days)

• Restrict use of outdated frameworks

4.4 All third-party libraries and dependencies shall be monitored for vulnerabilities.

5. Audit Logging and Monitoring

5.1 The Vendor shall maintain complete, tamper-resistant audit logs for:

• Successful and failed logins

• All data access events

• Administrative actions, including PIN creation/deactivation

5.2 Logs shall be retained based on business, legal, and regulatory requirements.

5.3 Logs must include timestamps synchronized via NTP and sufficient detail for forensic review.

5.4 Vendor shall support county audits of logging and cybersecurity controls upon request.

5.5 Integration: (as appropriate) Provide APIs or forwarding to the county SIEM/SOC; time synchronization (NTP) across systems

6. Incident Response and Breach Notification

6.1 The Vendor shall maintain a documented incident response plan covering detection, containment, eradication, recovery, and post-incident review.

6.2 Vendor shall notify Hillsborough County of any suspected or confirmed security incident affecting County data or System credentials:

• Within 24 hours of detection for suspected compromise

• Immediately for confirmed breaches

6.3 Vendor shall fully cooperate with county investigations and third-party forensic examiners.

6.4 Vendor shall provide a written root-cause analysis and corrective action plan within ten (10) business days following incident closure.

6.5 Cooperation: Support forensics, containment, eradication, and recovery; preserve relevant logs; do not impede investigations.

7. Business Continuity and Disaster Recovery

7.1 The Vendor shall maintain BC/DR plans that include:

• Documented RTO and RPO

• Encrypted backups stored in the United States

• Annual BC/DR testing

7.2 The System shall maintain 24/7 availability except for approved scheduled maintenance.

7.3 Test results and remediation plans shall be provided to the county upon request.

8. Third-Party / Sub-Processor Management

8.1 The Vendor shall disclose all subcontractors and sub-processors with access to county data.

8.2 The Vendor shall ensure all sub-processors comply with the cybersecurity requirements of this Contract.

8.3 No new subcontractor may be added without prior written county approval.

8.4 Sub-processors must store and process data only within the United States unless otherwise approved in writing.

8.5 Due Diligence: Conduct security assessments of Subcontractors; maintain a vetted list; notify the county prior to onboarding.

8.6 Supply Chain Security: Maintain tamper-evident processes; verify the integrity of software artifacts;

monitor for compromised dependencies.

9. Data Retention and Destruction

9.1 The Vendor shall implement retention schedules for:

• Inquiry records

• Identity status responses

• Credit rating responses

9.2 Destruction shall comply with NIST SP 800‑88; provide a Certificate of Destruction upon contract termination or county request; delete all county Data within 30 days of a written deletion request unless legally prohibited.

9.3 Upon contract termination or at the county’s request, Vendor shall provide a Certificate of Destruction.

10. Compliance Documentation and Verification

10.1 Vendor shall provide evidence of compliance, including (if available):

• SOC 2 Type II reports

• Independent penetration testing summaries

10.2 The vendor must complete all applicable county cybersecurity questionnaires and participate in all mandated reviews. The number of security forms needed depends on the risk and set-up of the proposed solution. Vendors might have to fill out several forms depending on where and what technology is used.

These forms help check how well the vendor meets county standards.

10.3 Failure to demonstrate compliance may result in proposal rejection or contract termination or may result in withholding of compensation until deficiency is corrected.

11. Privacy, Legal and Regulatory

11.1 Where applicable, Vendor shall comply with relevant privacy laws and sector regulations (e.g., HIPAA, FERPA, CJIS, PCI DSS). Vendors must support Data Subject Requests and regulatory audits as required by the county.

12. Cyber Insurance & Liability

12.1 Maintain Cyber Liability Insurance with minimum coverage, including coverage for incident response, regulatory defense, and notification costs cyber extortion, and business interruption. Evidence of coverage shall be provided upon reward and upon renewal.

13. Right to Audit & Continuous Compliance

13.1 The county reserves the right to audit Vendor’s security controls (reasonable notice) and to require independent assessments. Vendor shall provide periodic attestation (annually) of continued compliance and notify the County within 5 business days of material changes affecting security posture. The Vendor shall notify the County within five (5) business days of material changes affecting security posture (e.g., hosting region changes, control downgrades, new Sub-processors)

14. AI/ML & Automated Decision-Making Applications that use Artificial Intelligence must complete the Hillsborough County Certification of AI

Alignment to ensure compliance with requirements for usage, transparency, fairness, and accuracy.

14.1 Data Usage & Model Training

• Prohibition: The Vendor and its Sub-processors shall not use County Data (including prompts, inputs, outputs, or metadata) to train, fine-tune, or evaluate foundational AI/ML models without prior written approval from the County.

• Isolation: The Vendor shall certify [FM1.1] that County Data is strictly isolated from the Vendor’s general training corpus and other customers’ data.

14.2 Transparency

• Bot Disclosure: If the system utilizes a public-facing chatbot or synthetic media, the Vendor shall implement automated disclosures notifying users of AI interaction at the start of every session.

• Documentation: The Vendor shall provide Transparency or Model Cards detailing the model’s training data origins, known limitations, and bias testing results.

• Traceability: The Vendor shall maintain a versioning log of all AI models used. The County must be notified within 60 days of any significant underlying model updates.

14.3 Safety, Fairness, & Accuracy

• Guardrails: Vendor shall implement guardrails to prevent data leakage (e.g., content filters, redaction, access controls)

• Disable Requirement: For high-risk applications (as determined by the County), the Vendor shall provide a manual override or Killswitch allowing the County to instantly disable AI features without impacting core system functionality.

• Bias Mitigation: The Vendor shall provide evidence of regular audits for fairness and accuracy. and provide citation to the source data for every output.

• Human-in-the-loop: The system shall support a human review workflow. The County reserves the right to mandate a minimum sampling rate for manual verification of AI outputs.

14.4 Adversarial Defense (AI Security)

• Threat Protection: The Vendor shall implement controls aligned with the OWASP Top 10 for LLM Applications, specifically protecting against prompt injection, data poisoning, and sensitive information disclosure.

• Red-Teaming: The Vendor shall conduct annual Red-Teaming exercises for AI-specific vulnerabilities and provide an executive summary of findings to the County.

14.5 Data Residency & Sub-processors

• Domestic Processing: All AI processing and inference (including third-party API calls) must occur within the United States for data classified as Restricted or Confidential, unless a written exception is granted.

• DPA Requirement: The Vendor shall provide the Data Processing Addendum (DPA) between the Vendor and any third-party AI provider (e.g., OpenAI, Microsoft Azure AI) to ensure alignment with County privacy standards.

Cybersecurity Requirements Revision History Version ID Date of Change Author Section/Page Revision

2026V1 04/27/2026 Cyber/AI New Document Standards document for RFP/ITB

2026V1.1 04/27/2026 Cyber/AI 14.2 Removed “& Florida SB 482 Compliance”

2026V1.2 05/25/2026 Cyber/AI/Legal various See Legal Response

2026V1.3 06/26/2026 Cyber/AI/Legal Purpose, Definitions Legal Response