Appendix_S_-_Security_Requirements.docx
DOCX document 75 KB Posted
- Attached to
- Digital Signage Kiosk System (Rebid)
- Solicitation number
- 2025-RFP-0045R
- Issued by
- Sacramento County, California
About this file
Appendix S - Security Requirements Summary
Appendix S is a security requirements document for Sacramento County's Digital Signage Kiosk System RFP #2025-RFP-0045R (Rebid). The appendix establishes mandatory and desirable security specifications organized by solution type: All Respondents (applicable to all vendors), Cloud Solutions, Hybrid Solutions, and On-Premises Solutions. Respondents must address only the All Respondents section and sections corresponding to their proposed solution type. The document references NIST 800-53 v5 standards throughout and uses response codes to indicate compliance status: [Y] for current capability, [YR] for capability requiring custom programming, [P] for planned future releases, and [N] for no current or planned support. All Respondents must address three requirements and multiple desirable specifications covering cryptographic modules, Single Sign On (SSO/SAML) support, audit information protection, multi-factor authentication (MFA) for administrative accounts, and code analysis for internally-developed code.
Cloud and Hybrid solution providers must address 30 additional security requirements including GovRAMP authorization status, vulnerability remediation timelines (High within 30 days, Moderate within 90 days, Low within 180 days), SIEM implementation with 90 days online and 365 days total storage capacity, malware detection and eradication capabilities, disaster recovery planning, configuration management, incident response procedures, physical access controls, and monitoring systems. On-Premises and Hybrid solution providers must address four additional requirements specifying support for Tanium system patching and vulnerability scanning, security patch application within 30 days of vendor release, CrowdStrike Falcon endpoint security compatibility, and Splunk Universal Forwarder or equivalent log forwarding capabilities for integration with the County's SIEM infrastructure.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Digital_Signage_Kiosk_System_(Rebid).pdf | ||
| Supplement_B_-_Sample_Agendas_and_Legal_Notices.pdf | ||
| Supplement_A_-_Current_Kiosk_Interface_and_Placement.pdf | ||
| Appendix_Y_-_RFP_Submittal_Checklist.docx | DOCX document | |
| Appendix_S_-_Security_Requirements.docx | DOCX document | |
| Appendix_T_-_Solution_Requirements.xlsx | XLSX spreadsheet | |
| Appendix_H_-_Customer_References.docx | DOCX document | |
| Appendix_R_-_Minimum_Qualifications.docx | DOCX document | |
| Appendix_I_-_Pricing.docx | DOCX document | |
| Risk_Assessment_Questionnaire.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFP # 2025-RFP-0045R
Digital Signage Kiosk System DRAFT 8_21_18 v. 4.0
APPENDIX S - Security Requirements These security requirements represent both infrastructure and application requirements. It contains questions for All Respondents, Cloud Solutions, Hybrid Solutions, and On-Premises Solutions. You are only required to respond to the All Respondents section and the sections that match the solution being offered.
· Cloud Solution: The use of Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), and others storing, processing, and/or transmitting of COUNTY Data in environments outside the control of the COUNTY.
· Hybrid Solution: The use of both a Cloud Solution and an On-Premises Solution.
· On-Premises Solution: The use of a solution that is installed and run on servers that are on the COUNTY’s premises.
Definitions of the table heading:
| Item # |
| A unique question number. |
| Type |
| The requirement or question will be one or more of the following types: |
· [D] Desirable – Specification that is not required. Failure to meet this specification or item will NOT disqualify your response.
· [R] Required/Mandatory – You must satisfy or exceed this specification or element for your response to be deemed acceptable. If your system does not currently address the requirement, but can be modified to accommodate the requirement, indicate in your response the resources needed to make this accommodation (i.e., work plan, personnel, elapsed time, man-hours, and/or total costs).
· Narrative Request. Required to be answered.
| Requirement or Question |
| The requirement or question. |
| Response Code |
| References to the response codes listed below. Use these response codes to answer the questions in the appropriate sections: |
· [Y] Yes, in current release, satisfies requirement straight out of the box.
· [YR] Yes, in current release, satisfies requirement with custom programming or beyond normal configuration. Comments and/or additional pricing required.
· [P] In next planned release. Comments and estimated release date required.
· [N] No, neither in current release nor planned in future releases.
Although your solution may not directly satisfy a requirement, if you believe modifications or adjustments are possible to satisfy the requirement respond with a P for planned and explain in the comment column.
Security Requirements (All Responders)
SECURITY REQUIREMENTS
| Item # |
| Type |
| Requirement or Questions |
| Response Code |
| Contractor Response/ Comments/Assumptions |
| S-1 |
| D |
| Are modern cryptographic modules consistently used where cryptography is required? |
REFERENCE: NIST 800-53 v5 Data at Rest [SC-28] Transmission [SC-8 (1), SC-12, SC-12(2, 3)] Remote Access [AC-17 (2)] Authentication [IA-5 (1)] Digital Signatures/Hash [CM-14]
| S-2 |
| D |
| Can the system support Single Sign On (SSO/SAML)? |
REFERENCE: NIST 800-53 v5 [IA-8]
| S-3 |
| R |
| Does the system protect audit information from unauthorized access, modification, and deletion? |
REFERENCE: NIST 800-53 v5 [AU-7, AU-9]
| S-4 |
| D |
| Does the system require multi-factor authentication (MFA) for administrative accounts and functions? |
REFERENCE: NIST 800-53 v5 [IA-2, IA-2(1)]
| S-5 |
| D |
| Do you conduct code analysis for internally-developed code? |
REFERENCE: NIST 800-53 v5 [SA-11]
Security Requirements (Cloud and Hybrid)
SECURITY REQUIREMENTS (CLOUD)
| Item # |
| Type |
| Requirement or Questions |
| Response Code |
| Contractor Response/ Comments/Assumptions |
| S-6 |
| D |
| Does your solution leverage any Artificial Intelligence (AI)? |
| S-7 |
| D |
| Does your solution store customer data that is accessible by the Vendor? |
| S-8 |
| D |
| Is the system GovRAMP Authorized? https://GovRAMP.org/ |
| S-9 |
| D |
| Can the system become GovRAMP Ready within 1 year and Authorized within 18 months of contract issuance? |
| S-10 |
| D |
| Does the Service Provider scan for and consistently remediate High vulnerabilities within 30 days, Moderate vulnerabilities within 90 days, and Low vulnerabilities within 180 days? |
REFERENCE: NIST 800-53 v5 [RA-5]
| S-11 |
| D |
| Do you scan for configuration settings on systems in the environment? |
REFERENCE: NIST 800-53 v5 [CM-6]
| S-12 |
| D |
| Does the Service Provider and system utilize and audit and event monitoring solution (SIEM) that can support 90 days of online storage and 365 days of event/log data? |
REFERENCE: NIST 800-53 v5 [AU-2, AU-3, AU-8, AU-11]
| S-13 |
| D |
| Does the system’s external DNS solution support DNS Security (DNSSEC) to provide origin authentication and integrity verification assurances? |
REFERENCE: NIST 800-53 v5 [SC-20, SC-21]
| S-14 |
| D |
| Does the system enforce logical access according to established access control policies? |
| S-15 |
| D |
| Does the system enforce a limit on the number of invalid login attempts within a 15-minute period? |
| S-16 |
| R |
| Does the system ensure secure separation of customer data? |
REFERENCE: NIST 800-53 v5 [SC-4]
| S-17 |
| D |
| Does the Service Provider ensure that all non-essential services, functions, and ports are disabled? |
| S-18 |
| R |
| Does the system have the capability to detect, contain, and eradicate malicious software? |
REFERENCE: NIST 800-53 v5 [SI-3, PL-9, MA-3 (2)]
| S-19 |
| R |
| Does the Service Provider have the capability to recover the system to a known and functional state following an outage, breach, DoS attack, or disaster? |
REFERENCE: NIST 800-53 v5 [CP-2, CP-2 (2), CP-2 (3), CP-9, CP-10]
| S-20 |
| R |
| Does the Service Provider maintain a current, complete, and accurate inventory of the information system software, hardware, and network components? |
REFERENCE: NIST 800-53 v5 [CM-8]
| S-21 |
| D |
| Does the Service Provider perform regular maintenance on the system that is tracked, approved, and tested prior to implementation? |
| S-22 |
| R |
| Does the Service Provider follow a formal change control process that includes a security impact assessment? |
REFERENCE: NIST 800-53 v5 [CM-3, CM-4]
| S-23 |
| D |
| Does the Service Provider back up the information system and information system documentation? |
| S-24 |
| R |
| Does the Service Provider employ automated mechanisms to detect inventory and configuration changes? |
REFERENCE: NIST 800-53 v5 [CM-2(2), CM-6(1), CM-8(3)]
| S-25 |
| R |
| Does the Service Provider prevent unauthorized changes to the system? |
REFERENCE: NIST 800-53 v5 [CM-5, CM-5(1), CM-5(5)]
| S-26 |
| R |
| Does the Service Provider have an Incident Response Plan and Incident Response Testing Plan? |
REFERENCE: NIST 800-53 v5 [IR-3] [IR-8]
| S-27 |
| R |
| Does the Service Provider have a Configuration Management Plan? |
REFERENCE: NIST 800-53 v5 [CM-9, CM-11]
| S-28 |
| R |
| Does the Service Provider have a Contingency Plan and a fully developed Contingency Plan test? |
REFERENCE: NIST 800-53 v5 [CP-2, CP-8]
| S-29 |
| R |
| Does the Service Provider restrict physical system access to only authorized personnel? |
REFERENCE: NIST 800-53 v5 [PE-2 through PE-6, PE-8]
| S-30 |
| R |
| Does the Service Provider monitor and log physical access to the information system, and maintain access records? |
REFERENCE: NIST 800-53 v5 [PE-6, PE-8]
| S-31 |
| R |
| Does the Service Provider monitor and respond to physical intrusion alarms and surveillance equipment? |
REFERENCE: NIST 800-53 v5 [PE-6 (1)]
| S-32 |
| D |
| Does the system have or use alternate telecommunications providers? |
REFERENCE: NIST 800-53 v5 [CP-8, CP-8 (2)]
| S-33 |
| D |
| Does the system have backup power generation or other redundancy? |
REFERENCE: NIST 800-53 v5 [PE-11]
| S-34 |
| D |
| Does the Service Provider perform exit interviews with terminated personnel to retrieve items/disable access? |
| S-35 |
| D |
| Does the Service Provider have service level agreements (SLAs) in place with all telecommunications providers? |
REFERENCE: NIST 800-53 v5 [CP-8 (1)]
Security Requirements (On-Premises and Hybrid)
SECURITY REQUIREMENTS (ON-PREMISES)
| Item # |
| Type |
| Requirement or Questions |
| Response Code |
| Contractor Response/ Comments/Assumptions |
| S-36 |
| D |
| Does the solution support installation and use of Tanium for system patching, vulnerability scanning and compliance? |
| S-37 |
| D |
| Can security patches be applied within 30 days of release from vendor for all included operating systems and software? |
| S-38 |
| D |
| Does the solution support installation and use of CrowdStrike Falcon for system security? |
| S-39 |
| D |
| Does the solution support installation and use of Splunk Universal Forwarder or does the solution have an equivalent log forwarding capabilities for sending system audit logs to the County’s SIEM? |
Appendix S - Security Requirements Page 2 of 10 image1.png
File details come from the government source that posted it. Updated .