Att._1-Exh._H,_DGS_IT_Infrastructure_Standards___Guidelines.doc

BU 7760 EVENT ID 0000031656

Attachment 1-Exhibit H

ATTACHMENT 1-EXHIBIT H

DGS IT INFRASTRUCTURE STANDARDS AND GUIDELINES – PUBLIC

Purpose

This document establishes the standards and guidelines for the California Department of General Services (DGS) information technology environment to ensure the confidentiality, integrity, and availability of technology resources. All technology procurements, projects, and efforts must comport with the below DGS Information System Standards and Product Designations.

Scope

This document applies to all Information Technology hardware, software, facilities, applications, and networks that are a part of DGS’ computing resources. The specific technology categories addressed in this standard include:

1. Information Protection

2. Information Management

3. Information Distribution

4. Applications

5. Network Facility and Environment

6. Computing Resources

7. Voice Communications

DGS Information System Standards

The following DGS information system standards are requirements for all custom and commercial-off-the-shelf (COTS) system implementations. Vendor-based solutions must adhere to these standards and any vendor proposal must certify that the proposed solution will meet these standards. Exceptions to the some of the standards may by granted on a case-by-case basis for implementations that are: 1) fully vendor hosted and/or supported as evident through the vendor contract language, or 2) in the process of being upgraded to meet the standards.

General Standards

1. Solution includes Single Sign On integration with DGS Active Directory.

2. Solution executes on an Operating System that will have security patch support for at least 3 years from the date of the RFO was issued.

3. Solution must be compatible with all critical Operating System security patches within 90 days of the release of the security patch.

4. Solution must communicate over TCP/IP v4 on standard and/or clearly defined network ports. Dynamic and/or ephemeral port ranges are unacceptable.

5. The Solution’s web-based user interface must be compatible with the latest version of Google Chrome and Microsoft Edge browser in either native or compatibility mode.

6. Any network servers required by the Solution that will be hosted on the DGS’s network must be:

a. Completely compatible with VMWare vSphere 7.0 and NSX-T 3.0. There can be no physical licensing or security hardware required for the Solution’s operation. For example, the Solution cannot require a USB dongle for license compliance.

b. MS Windows Server 2019 compatible. Ad hoc approval is need for version deviation.

c. RedHat Enterprise 7.6 and above if needed.

d. MS SQL Server 2019 compatible. Ad hoc approval is need for version deviation.

e. Cloud based or located physically at a DGS Solution Center and allow for software updates.

7. In cases where a solution requires a direct machine interface and must be co-located with the machine, (such as machine state, yield/scrap, machine speed/temperature metrics) the computing equipment must be located in a self-contained server cabinet providing: a closed loop system for cooling, powering, protecting and housing computing equipment and allow for UPS/battery, fire suppression, and remote access.

Network Standards The proposed solution must be able to be deployed on a converged network and meet or exceed the following network requirements:

1. ISO 35.110, Networking.

2. IEEE 802.3, Communication Standards.

3. ANSI/TIA-568-C.0, Generic Telecommunications Cabling for Customer Premises, Ed. C, Amd. 2, 08-2012.

4. ANSI/TIA-568-C.1, Commercial Building Telecommunications Cabling Standard, Ed. C, Amd. 2, 05-2012.

5. ANSI/TIA-568-C.2, Balanced Twisted-Pair Telecommunication Cabling and Components Standard, Ed. C, Err. 04-2014.

6. ANSI/TIA-568-C.4, Broadband Coaxial Cabling and Components Standard, Ed. C, 07-2011.

7. TIA-569-B (2004; Amd 1 2009) Commercial Building Standard for Telecommunications Pathways and Spaces.

8. ANSI/TIA/EIA-606-A-2002, Administration Standard for Commercial Telecommunications Infrastructure.

Security Standards

DGS uses the American National Standards Institute (ANSI) and the FIPS standards in their information management planning and operations.

1. The minimum security requirements of the system shall use National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53A, Rev 4, at the moderate level or the most recently published revision.

2. State requirements as outlined in the California State Administrative Manual Section 5300, available at: http://sam.dgs.ca.gov/TOC/5300.aspx

3. If remote access is used, it must also comply with State of California, Statewide Information Management Manual (SIMM) 5360-A, Telework and Remote Access Security Standard (October 2018), available at: https://cdt.ca.gov/wp-content/uploads/2018/01/SIMM-5360A_2018-1018.pdf Definitions

The following tags will be used to clarify which technology is advocated as a standard and which is not but still being supported by DGS. If no tag is specified, then the technology is considered standard.

1. "Standard" – The technology or version of technology that is advocated as standard. All new projects will use these technologies if applicable.

2. "Supported" - For on-going projects, supported technologies are tagged with "Supported" to indicate that DGS will support them even though they are not the standard.

3. "In Consideration" - These are new technologies that are currently being vetted for adoption but not yet a “Standard”.

Identity and Access Management (IAM)

1. Azure Active Directory Service

2. Localized Active Directory (Supported)

3. Azure B2C – External user management for external facing applications

Web Development technologies

1. Kendo MVC (Supported)

2. .NET Core

3. .NET MVC

4. HTML5 for media-intensive applications

5. Angular

6. Python

7. C#

8. Web Service, Web API

9. Bootstrap

JavaScript Libraries

1. jQuery

2. React (in consideration)

3. Any custom JavaScript is considered code and will go through the same code integration and deployment life cycle as normal .NET Code including code review, RFC, and more.

4. All JavaScript files that are included from State of California Website template

Azure Technologies

1. Azure SQL Managed Instance

2. Azure Storage Accounts

3. Azure App service

4. Azure Virtual Machine

5. Azure Monitor

6. Azure Key/Vault

7. Azure Event Grid

8. Azure App Gateway

9. Azure Container Registry

10. Redis Cache

11. Azure API Management Gateway

Payment Gateway

1. PayPoint

Integrated Mailing Service

1. O365 mail service using encrypted port

Data Encryption in Transit

Applies to all traffic whether it is internal or external.

1. For HIPAA and FTI, use 4096- bit key encryption

2. For all other data classifications, use 2048-bit key encryption

3. File Share data in-transit encryption, use SMB 3.0 or above

TLS Certificate

1. Use third party certificate for external traffic

a. DigiCert

2. Use the internal certificate for internal traffic

3. Use latest TLS version

Code Repository and Branching

1. Azure DevOps Service

Code Deployment and release management

1. Azure DevOps Service

Reporting Tools

1. PowerBI (US Government) i.e., https://app.powerbigov.us

2. PowerBI VM (Azure) (Supported)

3. PowerBI on-prem - for all PowerBI reports that are consumed internally. (Supported)

4. SSRS 2019 - For reports that are consumed internally. For reports that are more tabular in nature.

Web Application Hosting Platform Technology

1. Microsoft IIS 10 Web Server or above Database

1. SQL Server 2019

2. SQL Server 2016 (Supported)

3. Active Directory Service Account must be used for database connection unless otherwise exempt.

Database Administration tool

1. SQL Server Management Studio

2. SQL Developer (Supported)

Operating System

1. Windows Server 2019 and above

2. Windows Server 2016 (Supported)

Data Encryption at rest

1. For HIPAA and FTI, all data at rest must be encrypted.

2. Transparent Data Encryption (TDE) must be used for Database file encryption

Document Repository

1. Microsoft SharePoint Online

Collaboration tools

1. Microsoft TEAM

2. Microsoft OneDrive for Business

3. Microsoft SharePoint Online

Data Classifications and requirements alignment

1. Compliance with Health Insurance Portability and Accountability Act (HIPAA)

2. Compliance with IRS Pub 1075

3. Compliance with CA Information Protection Act (Civil Code Section 1798 et seq)

4. Compliance with latest version of Payment Card Industry Data Security Standard (PCI-DSS) All PCI data will be stored in the payment gateway's cloud. No PCI data shall be stored on-prem, or in any of DGS's public cloud including AWS, Azure, IBM IaaS, and Oracle Cloud.

5. Compliance with SIMM 5305-A Information Security Program Management Standard (Information Asset Categorization and Classification) for public and non-public information Web Browser Requirements for external facing web applications

1. Microsoft Edge (Latest version)

2. Google Chrome (Latest version)

3. Firefox (Latest version)

4. Safari (Latest version)

Internal DGS Web Browser Requirement

1. Microsoft Edge

Accessibility (ADA compliance)

1. Web Content Accessibility Guidelines WCAG 2.0