Appendix B. SSBCI-TA-Capital-Programs-RFA-Appendix-B-ESD-Security-Standard-Brief.pdf

This document is an Information Security Standard Brief appendix prepared by New York's Empire State Development (ESD) agency for the SSBCI Technical Assistance to Capital Programs Round 2 request for applications. The brief establishes mandatory security and compliance requirements that all contractors, vendors, partners, and third-party service providers must meet when engaging with ESD on projects with data or IT components. Within 30 days of contract signing, vendors must identify applicable IT deliverables from ESD's IT Deliverables Standard and document these as project milestones aligned with ESD business requirements. The standard applies to technical assistance providers offering legal, accounting, and financial services to eligible beneficiaries, specifically very small businesses and socially and economically disadvantaged individual-owned businesses applying for SSBCI capital programs.

All parties must comply with ISO Standards 27001, 27005, and 27035 regarding protection of ESD's network, data, and information systems, with documented monitoring processes in place for third-party compliance verification. Contractors must provide certifications that all vendors in their supply chain comply with applicable ISO standards, implement Identity Access Management with authentication and transaction auditing where applicable, and maintain documented records of all third-party access to ESD data or information systems. Additionally, contractors must comply with GDPR standards for data collection and protection, adhere to New York State and Federal Cyber Security and Information Security Policies and Laws, and manage information communications to maintain ESD data security. The IT Deliverables Standard will be provided to prospective vendors prior to contract completion or upon request.