Appendix-A-ESD-Security-Brief.pdf
PDF 94 KB Posted
- Attached to
- New York Global Entrepreneurs Program
- Solicitation number
- 2139587
- Issued by
- New York
About this file
This is an Information Security Brief (Appendix A) establishing security standards and compliance requirements for all vendors, contractors, and third parties engaging with the New York Empire State Development (ESD) organization on projects with data or IT components. The brief mandates that all partners comply with ISO Standards 27001, 27005, and 27035 for protection of ESD's network, data, and information systems, and requires adherence to GDPR standards for data collection and protection when systems process information from entities or citizens within GDPR governance scope. Additional IT deliverables applicable to specific projects must be identified within 30 days of contract signing and documented as project milestones in alignment with ESD business requirements, with the IT Deliverables Standard to be provided to prospective vendors prior to contract completion or upon request. All third-party access to ESD data or information systems must be documented, and AI use shall comply with all applicable State and Federal Laws and ESD policies.
Partners must establish and maintain documented monitoring processes for third-party compliance, provide Identity Access Management capabilities including authentication and transaction auditing where applicable, and supply documentation certifying that all vendors in the supply chain comply with the specified ISO standards relative to their project roles. Contractors must adhere to New York State and Federal Cyber Security and Information Security Policies and Laws, and manage information communications to maintain the security of ESD data. These security requirements apply uniformly across all ESD engagements regardless of contract value or procurement category, establishing baseline protection standards for the protection of state resources and information assets.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| NY Global Entrepreneurs Program,RFA, Round 2-Final.pdf | ||
| Sample GlobaEIR University Agreement.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Version 2
ESD Information Security Brief
All engagements with ESD that have a data or IT component are subject at a minimum, to the following security standards and guidelines as they relate to the safeguarding of ESD information and resources. Additional deliverables that are applicable to the project should be identified from ESD’s IT Deliverables Standard within 30 days of contract signing, documented as milestones in the project plan, and delivered in alignment with ESD business requirements. The IT Deliverables Standard will be provided to prospective vendors prior to contract completion or upon request.
• Security Compliance
• Partners, contractors, vendors, suppliers and all other 3rd parties working with ESD or ESD’s contracted vendors must comply with ISO Standards 27001, 27005 and 27035 as they relate to the protection of ESD’s network, data and information systems. For more information about these and other ISO standards visit https://www.iso.org
• AI use shall comply with all applicable State and Federal Laws and if applicable, ESD policies
• Must have monitoring process in place and documented for 3rd party compliance
• If applicable, must provide Identity Access Management, including authentication and transaction auditing
• Must provide documentation certifying that all 3rd party vendors in the supply chain are complying with ISO standards 27001, 27005 and 27035 as related to their role in the project
• Must comply with GDPR standards for data collection and protection. For more information about GDPR please visit https://gdpr.eu/ o GDPR is applicable when developing or using a system that is collecting or storing information from entities or citizens that fall within the scope of GDPR governance.
• Must adhere to NYS and Federal Cyber Security and Information Security Polices and Laws
• Must document all 3rd party access to ESD data or information systems
• Must manage Information Communications to maintain the security of ESD data https://www.iso.org/ https://gdpr.eu/
File details come from the government source that posted it. Updated .