Appendix A - ESD IT Security_Standard_Brief.pdf
PDF 98 KB Posted
- Attached to
- NYS Worldwide Consultancy, RFP
- Solicitation number
- 2136750
- Issued by
- New York
About this file
IT Security Standards Appendix for NYS Empire State Development Worldwide Consultancy RFP
This document is an Information Security Brief (Version 6) issued by Empire State Development (ESD), a New York State agency, establishing mandatory IT security standards and compliance requirements for all contractors, vendors, and third parties engaged in projects with data or IT components. The security standards outlined apply to all engagements with ESD and must be incorporated into project deliverables within 30 days of contract signing and documented as project milestones. Contractors may demonstrate compliance using comparable security standards if approved by ESD's Chief Information Security Officer (CISO). The standards establish a comprehensive framework governing the safeguarding of ESD information and resources throughout the contractor's performance period.
All contractors must comply with ISO Standards 27001, 27005, and 27035 regarding protection of ESD's network, data, and information systems, with mandatory documentation certifying that all third-party vendors in the supply chain meet these standards. Additional requirements include GDPR compliance for systems collecting or storing information from entities or citizens within GDPR jurisdiction, adherence to NYS and Federal Cyber Security and Information Security Policies and Laws, implementation of documented monitoring processes for third-party compliance, provision of Identity Access Management with authentication and transaction auditing capabilities, documentation of all third-party access to ESD data or information systems, and management of information communications to maintain data security. AI use must comply with all applicable State and Federal Laws and ESD policies. The IT Deliverables Standard, which identifies additional applicable deliverables specific to each project, will be provided to prospective vendors upon request.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| NYS Worldwide Consultancy, Final.pdf | ||
| Appendix B - Fee Proposal 2026.xlsx | XLSX spreadsheet | |
| Appendix D - RFP Intake-Form.docx | DOCX document | |
| ADDENDUM I - Submission of Technical Proposal with Appendix D.pdf | ||
| ADDENDUM II - Q&A Matrix.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Version 6
ESD Information Security Brief
If applicable, the Standards, Policies and requirements outlined in this document apply.
All engagements with ESD that have a data or IT component are subject at a minimum to the following security standards and guidelines as they relate to the safeguarding of ESD information and resources. Additional deliveries that are applicable to the project should be identified from ESD’s IT Deliverables Standard within 30 days of contract signing, documented as milestones in the project plan, and delivered in alignment with ESD business requirements.
The IT Deliverables Standard will be provided to prospective vendors upon request. Vendor may demonstrate and satisfy compliance with the standards outlined below utilizing comparable Security Standards if approved by ESD's
CISO.
• Security Compliance
• Partners, contractors, vendors, suppliers and all other 3rd parties working with ESD or ESD’s contracted vendors must comply with ISO Standards 27001, 27005 and 27035 as they relate to the protection of ESD’s network, data and information systems. For more information about these and other ISO standards visit https://www.iso.org
• Use of AI shall comply with all applicable State and Federal Laws and if applicable ESD policies
• Must have monitoring process in place and documented for 3rd party compliance
• If applicable, must provide Identity Access Management, including authentication and transaction auditing
• Must provide documentation certifying that all 3rd party vendors in the supply chain are complying with ISO standards 27001, 27005 and 27035 as related to their role in the project
• Must comply with GDPR standards for data collection and protection. For more information about GDPR please visit https://gdpr.eu/ o GDPR is applicable when developing or using a system that is collecting or storing information from entities or citizens that fall within the scope of GDPR governance.
• Must adhere to NYS and Federal Cyber Security and Information Security Polices and Laws
• Must document all 3rd party access to ESD data or information systems
• Must manage Information Communications to maintain the security of ESD data https://www.iso.org/ https://gdpr.eu/
File details come from the government source that posted it. Updated .