APPENDIX_J_-_Security_Requirements.pdf

APPENDIX J - COUNTY OF SACRAMENTO

SECURITY REQUIREMENTS

These security requirements represent both infrastructure and application requirements.

Definitions of the table heading:

Item # A unique question number.

Type

The requirement or question will be one or more of the following types:

• [D] Desirable – Specification that is not required.

Failure to meet this specification or item will NOT disqualify your response.

• [R] Required/Mandatory – You must satisfy or exceed this specification or element for your response to be deemed acceptable. If your system does not currently address the requirement, but can be modified to accommodate the requirement, indicate in your response the resources needed to make this accommodation (i.e., work plan, personnel, elapsed time, man-hours, and/or total costs).

• Narrative Request. Required to be answered.

Requirement or Question

The requirement or question.

Response Code

References to the response codes listed below.

Use these response codes to answer the questions in the appropriate sections:

• [Y] Yes, in current release, satisfies requirement straight out of the box.

• [YR] Yes, in current release, satisfies requirement with custom programming or beyond normal configuration. Comments and/or additional pricing required.

• [P] In next planned release. Comments and estimated release date required.

• [N] No, neither in current release nor planned in future releases.

Although your solution may not directly satisfy a requirement, if you believe modifications or adjustments are possible to satisfy the requirement respond with a P for planned and explain in the comment column.

1. Security Requirements (All Responders)

Item # Type Requirement or Questions Response

Code

Contractor Response/Comments/

Assumptions

S-001 R

Are modern cryptographi c modules consistently used where cryptograph y is required?

REFERENCE:

NIST 800-53

v4 Data at Rest

[SC-28]

Transmission

[SC-8 (1),

SC-12, SC-

12(2, 3)] Remote Access [AC-17 (2)] Authentication

[IA-5 (1)]

Digital Signatures/Ha sh [CM-5 (3)]

# Type Requirement or Questions Response

Code

Contractor Response/Comments/

Assumptions

S-002 R

Can the system support Single Sign On

(SSO/SAML)

REFERENCE:

NIST 800-53

v4 [IA-08]

S-003 R

Does the system protect audit information from unauthorize d access, modification , and deletion?

REFERENCE:

NIST 800-53

v4 [AU-7, AU- 9]

# Type Requirement or Questions Response

Code

Contractor Response/Comments/

Assumptions

S-004 R

Does the system require multi-factor authenticati on (MFA) for administrati ve accounts and functions?

REFERENCE:

NIST 800-53

v4 [IA-2, IA-

2(1), IA-

2(3)]

S-005 R

Do you conduct code analysis for internally-developed code?

REFERENCE:

NIST 800-53

v4 [SA-11]

2. Security Requirements (Cloud and Hybrid)

SECURITY REQUIREMENTS (CLOUD)

# Type Requirement or

Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 006 D

Is the system StateRAMP Authorized?

https://statera mp.org/

S- 007 R

Can the system become StateRAMP Ready within 90 days and Authorized within 1 year of contract issuance?

008 R

Does the Service Provider scan for and consistently remediate High vulnerabilities within 30 days, Moderate vulnerabilities within 90 days, and Low vulnerabilities within 180 days?

REFERENCE:

NIST 800-53 v4

[RA-5]

https://stateramp.org/ https://stateramp.org/

# Type Requirement or

Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 009 R

Do you scan for configuration settings on systems in the environment?

REFERENCE:

[CM-6]

010 R

Does the Service Provider and system utilize and audit and event monitoring solution (SIEM) that can support 90 days of online storage and 365 days of event/log data?

REFERENCE:

NIST 800-53 v4

[AU-2, AU-3, AU-

8, AU-11]

# Type Requirement or

Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 011 D

Does the system’s external DNS solution support DNS Security (DNSSEC) to provide origin authentication and integrity verification assurances?

REFERENCE:

[SC-20, SC-21]

012 R

Does the system ensure secure separation of customer data?

REFERENCE:

[SC-4]

# Type Requirement or

Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 013 R

Does the system have the capability to detect, contain, and eradicate malicious software?

REFERENCE:

NIST 800-53 v4

[SI-3, SI-3 (1),

SI-3 (2), SI-3

(7), MA-3 (2)]

014 R

Does the Service Provider have the capability to recover the system to a known and functional state following an outage, breach, DoS attack, or disaster?

REFERENCE:

NIST 800-53 v4

[CP-2, CP-2 (2),

CP-2 (3), CP-9,

CP-10]

# Type Requirement or

Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 015 R

Does the Service Provider maintain a current, complete, and accurate inventory of the information system software, hardware, and network components?

REFERENCE:

[CM-8]

016 R

Does the Service Provider follow a formal change control process that includes a security impact assessment?

REFERENCE:

[CM-3, CM-4]

# Type Requirement or

Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 017 R

Does the Service Provider employ automated mechanisms to detect inventory and configuration changes?

REFERENCE:

NIST 800-53 v4

[CM-2(2), CM-

6(1), CM-8(3)]

018 R

Does the Service Provider prevent unauthorized changes to the system?

REFERENCE:

NIST 800-53 v4

[CM-5, CM-5(1),

CM-5(5)]

# Type Requirement or

Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 019 R

Does the Service Provider have an Incident Response Plan and Incident Response Testing Plan?

REFERENCE:

[IR-3] [IR-8]

020 R

Does the Service Provider have a Configuration Management Plan?

REFERENCE:

[CM-9, CM-11]

021 R

Does the Service Provider have a Contingency Plan and a fully developed Contingency Plan test?

REFERENCE:

[CP-2, CP-8]

# Type Requirement or

Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 022 R

Does the Service Provider restrict physical system access to only authorized personnel?

REFERENCE:

NIST 800-53 v4 [PE-2 through

PE-6, PE-8]

023 R

Does the Service Provider monitor and log physical access to the information system, and maintain access records?

REFERENCE:

[PE-6, PE-8]

# Type Requirement or

Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 024 R

Does the Service Provider monitor and respond to physical intrusion alarms and surveillance equipment?

REFERENCE:

[PE-6 (1)]

025 D

Does the system have or use alternate telecommunica tions providers?

REFERENCE:

[CP-8, CP-8 (2)]

026 D

Does the system have backup power generation or other redundancy?

REFERENCE:

[PE-11]

# Type Requirement or

Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 027 D

Does the Service Provider have service level agreements (SLAs) in place with all telecommunica tions providers?

REFERENCE:

[CP-8 (1)]

3. Security Requirements (On-Premises and Hybrid)

SECURITY REQUIREMENTS (ON-PREMISES)

# Type Requirement or Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 028 R

Does the solution support installation and use of Tanium for system patching, vulnerability scanning and compliance?

# Type Requirement or Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 029 R

Can security patches be applied within 30 days of release from vendor for all included operating systems and software?

030 R

Does the solution support installation and use of CrowdStrike Falcon for system security?

# Type Requirement or Questions Response

Code

Contractor Response/Comments/

Assumptions

S- 031 R

Does the solution support installation and use of Splunk Universal Forwarder or does the solution have an equivalent log forwarding capabilities for sending system audit logs to the County’s

SIEM?

End of RFP