APPENDIX B - Data Security Requirements_Final.docx

APPENDIX B

DATA SECURITY REQUIREMENTS

The Contractor shall address the following security standards that are deemed moderate risk in the EOP:

A. Access Management. Allow customer to manage their users’ access including creating, changing, or terminating accounts, reviewing account usage, and performing regular reviews of users and their privileges.

B. Account Management. Enforce use of unique identifiers (for example, username) for accessing the system. The assigned identifier must be traceable to the assigned user.

C. Authentication. Support the ability to require multifactor authentication (MFA) at the strongest implementation technically feasible for all user and administrator logins:

(a) Single sign-on (SSO) provided through EOP (note: SSO bypass for break glass or super user accounts is permissible); or

(b) Phishing-resistant MFA with a minimum of two factors (for example, FIDO/WebAuthn authentication, PKI-based MFA); or

(c) MFA with a minimum of two factors.

D. Contingency Plan. Maintain a contingency plan and conduct exercises of the plan at least annually. The plan must define roles, responsibilities, and procedures for backup and recovery.

E. Data Location. Store and process EOP data only within the United States and ensure any work on or with EOP data and accounts is conducted by individuals who are United States citizens or permanent residents.

F. Encryption. Enforce encryption for EOP data in transit and at rest.

(1) Encryption Strength - Provide strong encryption wherever encryption is used to protect EOP data:

i. Protect high risk EOP data with cryptography that provides at least 256 bits of security strength (AES-256, SHA-512, etc.).

ii. Protect all other EOP data with cryptography that provides at least 128 bits of security strength (AES-128, SHA-256, etc.).

iii. See National Institute for Standards and Technology (NIST) SP 800-131: Transitioning the Use of Cryptographic Algorithms and Key Lengths.

G. Endpoint Security. Implement the following endpoint security controls to secure the endpoints of third-party users (that is, the employees, agents, and vendors of the third party) with access to systems that store or process EOP data:

(a) Malicious code protection;

(b) Device encryption; and

(c) Data loss prevention controls (for example, disabling removable media ports, preventing data exfiltration).

H. Incident Notification. Notify the customer of any security incident involving EOP data as soon as aware but no later than 48 hours after discovery. Provide updates to the customer until incident resolution and provide a post-incident review to the customer.

I. Incident Response Planning. Establish an incident response plan that defines how the third party will respond to incidents on systems that store or process EOP data. The plan must define incident escalation procedures, incident communication protocols, and roles and responsibilities for responding to incidents, including the customers versus the third party’s incident responsibilities. Provide evidence of incident response planning when requested.

J. Incident Response Testing. Test the incident response plan:

(a) High Risk: At least every six months.

(b) Moderate Risk: At least annually.

K. Log Details. Capture the following details in logs:

(a) Event type

(b) Event location

(c) Event time

(d) Source

(e) Success or failure indicators

(f) Individuals (unique identifiers), accounts, processes, or systems associated with the event Session, connection, transaction, or activity duration.

L. Log Retention - Retain logs for at least:

(a) 12 months of active storage; that is, data stored in a way that allows frequent use and ease of access; and

(b) 18 months of cold data storage; that is, data stored in a way that minimizes cost while allowing for occasional or infrequent access.

M. Logged Events. Implement a logging system for tracking security events within applications and its underlying infrastructure and monitor logs through use of alerting and regular log reviews. Events to monitor must include, at a minimum:

(a) Successful and unsuccessful login events

(b) Changes to accounts, including addition, removal, and change of privileges

(c) Access to, creation of, movement of, or disposal of data

(d) Starting, stopping, or pausing audit logs

(e) Modifying audit logs

(f) Actions taken with administrative or elevated privileges, including actions taken from service or integration accounts N. Patching and Support. Use only operating systems and software versions that the vendor continues to support with security patches. Apply the vendor security patches at least monthly (unless they are of critical severity or zero-day mitigations and require faster remediation).

O. Roles and Permissions Implement roles or permission levels so that users may be assigned only the access they need to perform their assigned functions (that is, least privilege).