ATT J security.pdf
PDF 912 KB Posted
- Solicitation number
- S-KS0043-00012234
- Issued by
- Multnomah County, Oregon
About this file
This file is a Statewide Information Security Standards Spreadsheet (Attachment J) for RFP #S-DASOBO-00001233, the HECC Modernization Project. The document serves as a comprehensive security control matrix outlining how various information security and privacy controls will be met across the project implementation. The spreadsheet details control requirements across multiple domains including system planning and coordination, security architecture, audit and accountability, access control, identification and authentication, system and communications protection, incident response, system monitoring, physical security, and contingency planning. Each control is mapped to indicate whether it is implemented by the agency, vendor, shared between agency and vendor, provided as a base offering, offered as an add-on, managed by a third party, or not supported. The document provides columns for proposers to indicate the applicability of each control (all systems, moderate systems, on-premise, or off-premise) and their location relative to the agency, along with a section for vendor responses and comments regarding plans of action and milestones for any unsupported controls.
The spreadsheet encompasses numerous control enhancements and specific requirements such as multifactor authentication for privileged and non-privileged accounts, role-based access control, encryption of data in transit and at rest, automated audit processes, incident response automation, wireless intrusion detection, penetration testing, and comprehensive contingency planning provisions. The document requires detailed documentation of how security functions will be verified, maintained, and monitored throughout the modernization project. This control matrix establishes the foundational security posture and compliance framework that bidders must address in their proposals, ensuring alignment with federal and state information security standards for the HECC Modernization Project.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| SOLE SOURCE Fouch Electric.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ATTACHMENT J
STATEWIDE INFORMATION SECURITY STANDARDS
SPREADSHEET
RFP #S-DASOBO-00001233
HECC MODERNIZATION PROJECT
How Control is Met. (If not supported, please indicate your Plan of Action and Milestones.)
A ll
M o d e rate
O n P re m ise
O ff P re m ise
A ge n cy
V e n d o r
Sh are d
(age n cy/ve n d o r)
B ase
A d d ‐o n
Th ird
P arty
N o t su p p o rte d
Comments an
Plan of Action and Milestones Process X System Inventory X
System Security and Privacy Plans X
PLAN AND COORDINATE WITH OTHER ORGANIZATIONAL ENTITIES X
Rules of Behavior X
SOCIAL MEDIA AND NETWORKING RESTRICTIONS X
Security and Privacy Architectures X Baseline Selection X Baseline Tailoring X edures
Security Categorization X Risk Assessment X
SUPPLY CHAIN RISK ASSESSMENT X
Vulnerability Scanning X
UPDATE BY FREQUENCY, PRIOR TO NEW SCAN, OR WHEN IDENTIFIED X
PRIVILEGED ACCESS X
Risk Response X Criticality Analysis X nd Procedures
Audit Events X
REVIEWS AND UPDATES X
Content of Audit Records X
ADDITIONAL AUDIT INFORMATION X
Audit Storage Capacity X Response to Audit Processing Failures X
AUDIT STORAGE CAPACITY X
Audit Review, Analysis, and Reporting X
AUTOMATED PROCESS INTEGRATION X
CORRELATE AUDIT REPOSITORIES X
CENTRAL REVIEW AND ANALYSIS X
Proposer Response
Vendor Control is:
Requirement Implemented by Control Name
CONTROL ENHANCEMENT NAMES (are in caps)
Applicability Location (in relation to Agency)
RFP #S-DASOBO-00001233
A ll
M o d e rate
O n P re m ise
O ff P re m ise
A ge n cy
V e n d o r
Sh cy/ve n d o r)
B ase
A d d ‐o n
Th ird
P arty
N o t su p p o rte d
Comments
Proposer Response
Vendor Control is:
Requirement Implemented by Control Name
CONTROL ENHANCEMENT NAMES (are in caps)
Applicability Location (in relation to Agency)
Audit Reduction and Report Generation X
AUTOMATIC PROCESSING X
Time Stamps X
SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE X
SECONDARY AUTHORITATIVE TIME SOURCE X
Protection of Audit Information X
ACCESS BY SUBSET OF PRIVILEGED USERS X
READ‐ONLY ACCESS X
Audit Record Retention X Audit Generation X Cross‐Organizational Auditing X nd Procedures
Awareness Training X
INSIDER THREAT X
SOCIAL ENGINEERING AND MINING X
Role‐Based Training X Training Records X ocedures
Position Risk Designation X Personnel Screening X Personnel Termination X Personnel Transfer X Access Agreements X External Personnel Security X Personnel Sanctions X
Policy and Procedures
Allocation of Resources X System Development Life Cycle X Acquisition Process X
FUNCTIONAL PROPERTIES OF CONTROLS X
DESIGN AND IMPLEMENTATION INFORMATION FOR CONTROLS X
FUNCTIONS, PORTS, PROTOCOLS, AND SERVICES IN USE X
System Documentation X
RFP #S-DASOBO-00001233
A ll
M o d e rate
O n P re m ise
O ff P re m ise
A ge n cy
V e n d o r
Sh cy/ve n d o r)
B ase
A d d ‐o n
Th ird
P arty
N o t su p p o rte d
Comments
Proposer Response
Vendor Control is:
Requirement Implemented by Control Name
CONTROL ENHANCEMENT NAMES (are in caps)
Applicability Location (in relation to Agency)
Security and Privacy Engineering Principles X External System Services X
IDENTIFICATION OF FUNCTIONS, PORTS, PROTOCOLS, AND SERVICES X
Developer Configuration Management X Developer Testing and Evaluation X Supply Chain Risk Management X Development Process, Standards, and Tools X Unsupported System Components X n Policy and Procedures
Identification and Authentication (Organizational Users) X
MULTIFACTOR AUTHENTICATION TO PRIVILEGED ACCOUNTS X
MULTIFACTOR AUTHENTICATION TO NON‐PRIVILEGED ACCOUNTS
(Note this change in R5 to low baseline)
X
ACCESS TO ACCOUNTS — REPLAY RESISTANT X
Device Identification and Authentication X Identifier Management X Authenticator Management X
PASSWORD‐BASED AUTHENTICATION X
CHANGE AUTHENTICATORS PRIOR TO DELIVERY X
Authenticator Feedback X Cryptographic Module Authentication X Identification and Authentication (Non‐ Organizational Users) X Re‐authentication X Identity Proofing X
IDENTITY EVIDENCE X
IDENTITY EVIDENCE VALIDATION AND VERIFICATION X
ADDRESS CONFIRMATION X
ures
Account Management X
AUTOMATED SYSTEM ACCOUNT MANAGEMENT X
REMOVAL OF TEMPORARY AND EMERGENCY ACCOUNTS X
DISABLE ACCOUNTS X
AUTOMATED AUDIT ACTIONS X
SHARED AND GROUP ACCOUNT CREDENTIAL CHANGE X
ACCOUNT MONITORING FOR ATYPICAL USAGE
RFP #S-DASOBO-00001233
A ll
M o d e rate
O n P re m ise
O ff P re m ise
A ge n cy
V e n d o r
Sh cy/ve n d o r)
B ase
A d d ‐o n
Th ird
P arty
N o t su p p o rte d
Comments
Proposer Response
Vendor Control is:
Requirement Implemented by Control Name
CONTROL ENHANCEMENT NAMES (are in caps)
Applicability Location (in relation to Agency)
DISABLE ACCOUNTS FOR HIGH‐RISK INDIVIDUALS X
Access Enforcement X
ROLE‐BASED ACCESS CONTROL X
Information Flow Enforcement X Separation of Duties X Least Privilege X
AUTHORIZE ACCESS TO SECURITY FUNCTIONS X
NON‐PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS X
PRIVILEGED ACCOUNTS X
REVIEW OF USER PRIVILEGES X
AUDITING USE OF PRIVILEGED FUNCTIONS X
PROHIBIT NON‐PRIVILEGED USERS FROM EXECUTING PRIVILEGED
FUNCTIONS
X
Unsuccessful Logon Attempts X
PURGE OR WIPE MOBILE DEVICE X
System Use Notification X Device Lock X
PATTERN‐HIDING DISPLAYS X
REQUIRE USER‐INITIATED LOCK X
Session Termination X Permitted Actions without Identification or Authentication X Remote Access X
AUTOMATED MONITORING AND CONTROL X
PROTECTION OF CONFIDENTIALITY AND INTEGRITY USING ENCRYPTION X
MANAGED ACCESS CONTROL POINTS X
PRIVILEGED COMMANDS AND ACCESS X
Wireless Access X
AUTHENTICATION AND ENCRYPTION X
DISABLE WIRELESS NETWORKING X
Access Control for Mobile Devices X
FULL DEVICE AND CONTAINER‐BASED ENCRYPTION X
Use of External Systems X
PORTABLE STORAGE DEVICES X
NON‐ORGANIZATIONALLY OWNED SYSTEMS AND COMPONENTS X
Publicly Accessible Content X
RFP #S-DASOBO-00001233
A ll
M o d e rate
O n P re m ise
O ff P re m ise
A ge n cy
V e n d o r
Sh cy/ve n d o r)
B ase
A d d ‐o n
Th ird
P arty
N o t su p p o rte d
Comments
Proposer Response
Vendor Control is:
Requirement Implemented by Control Name
CONTROL ENHANCEMENT NAMES (are in caps)
Applicability Location (in relation to Agency) cy and Procedures
Baseline Configuration X
AUTOMATION SUPPORT FOR ACCURACY AND CURRENCY X
RETENTION OF PREVIOUS CONFIGURATIONS X
CONFIGURE SYSTEMS AND COMPONENTS FOR HIGH‐RISK AREAS X
Configuration Change Control X
TESTING, VALIDATION, AND DOCUMENTATION OF CHANGES X
SECURITY REPRESENTATIVE X
Security and Privacy Impact Analysis X
VERIFICATION OF SECURITY AND PRIVACY FUNCTIONS X
Access Restrictions for Change X Configuration Settings X Least Functionality X
PERIODIC REVIEW X
AUTHORIZED SOFTWARE — WHITELISTING X
System Component Inventory X
UPDATES DURING INSTALLATION AND REMOVAL X
AUTOMATED UNAUTHORIZED COMPONENT DETECTION X
Configuration Management Plan X Software Usage Restrictions X
OPEN SOURCE SOFTWARE X
User‐Installed Software X Information Location X
AUTOMATED TOOLS TO SUPPORT INFORMATION LOCATION X
Procedures
Controlled Maintenance X Maintenance Tools X
INSPECT TOOLS X
INSPECT MEDIA X
PREVENT UNAUTHORIZED REMOVAL X
Nonlocal Maintenance X Maintenance Personnel X Timely Maintenance X cedures
Media Access X Media Marking X
RFP #S-DASOBO-00001233
A ll
M o d e rate
O n P re m ise
O ff P re m ise
A ge n cy
V e n d o r
Sh cy/ve n d o r)
B ase
A d d ‐o n
Th ird
P arty
N o t su p p o rte d
Comments
Proposer Response
Vendor Control is:
Requirement Implemented by Control Name
CONTROL ENHANCEMENT NAMES (are in caps)
Applicability Location (in relation to Agency)
Media Storage X Media Transport X Media Sanitization X
REVIEW, APPROVE, TRACK, DOCUMENT, VERIFY X
Media Use X tection Policy and Procedures
Application Partitioning X Security Function Isolation X Information in Shared System Resources X Denial of Service Protection X Boundary Protection X
ACCESS POINTS X
EXTERNAL TELECOMMUNICATIONS SERVICES X
DENY BY DEFAULT — ALLOW BY EXCEPTION X
PREVENT SPLIT TUNNELING FOR REMOTE DEVICES X
ROUTE TRAFFIC TO AUTHENTICATED PRO1Y SERVERS X
PREVENT EXFILTRATION X
RESTRICT INCOMING COMMUNICATIONS TRAFFIC X
HOST‐BASED PROTECTION X
PROTECTS AGAINST UNAUTHORIZED PHYSICAL CONNECTIONS X
ISOLATION OF SYSTEM COMPONENTS X
Transmission Confidentiality and Integrity X
CRYPTOGRAPHIC PROTECTION X
Network Disconnect X Cryptographic Key Establishment and Management X Cryptographic Protection X Collaborative Computing Devices and Applications X Public Key Infrastructure Certificates X Mobile Code X
PREVENT AUTOMATIC EXECUTION X
Voice Over Internet Protocol X Secure Name/Address Resolution Service (Authoritative Source) X Secure Name/Address Resolution Service (Recursive or Caching Resolver) X
Architecture and Provisioning for Name/Address Resolution Service X Session Authenticity X
RFP #S-DASOBO-00001233
A ll
M o d e rate
O n P re m ise
O ff P re m ise
A ge n cy
V e n d o r
Sh cy/ve n d o r)
B ase
A d d ‐o n
Th ird
P arty
N o t su p p o rte d
Comments
Proposer Response
Vendor Control is:
Requirement Implemented by Control Name
CONTROL ENHANCEMENT NAMES (are in caps)
Applicability Location (in relation to Agency)
Protection of Information at Rest X
CRYPTOGRAPHIC PROTECTION X
Process Isolation X Port and I/O Device Access X ocedures
Incident Response Training X Incident Response Testing X
COORDINATION WITH RELATED PLANS X
Incident Handling X
AUTOMATED INCIDENT HANDLING PROCESSES X
SUPPLY CHAIN COORDINATION X
Incident Monitoring X Incident Reporting X
AUTOMATED REPORTING X
VULNERABILITIES RELATED TO INCIDENTS X
SUPPLY CHAIN COORDINATION X
Incident Response Assistance X
AUTOMATION SUPPORT FOR AVAILABILITY OF INFORMATION AND
SUPPORT
X
COORDINATION WITH EXTERNAL PROVIDERS X
Incident Response Plan X Information Spillage Response X y Policy and Procedures
Flaw Remediation X
AUTOMATED FLAW REMEDIATION STATUS X
Malicious Code Protection X
CENTRAL MANAGEMENT X
System Monitoring X
AUTOMATED TOOLS AND MECHANISMS FOR REAL‐TIME ANALYSIS X
INBOUND AND OUTBOUND COMMUNICATIONS TRAFFIC X
SYSTEM‐GENERATED ALERTS X
ANALYZE COMMUNICATIONS TRAFFIC ANOMALIES X
WIRELESS INTRUSION DETECTION X
HOST‐BASED DEVICES X
Security Alerts, Advisories, and Directives X
RFP #S-DASOBO-00001233
A ll
M o d e rate
O n P re m ise
O ff P re m ise
A ge n cy
V e n d o r
Sh cy/ve n d o r)
B ase
A d d ‐o n
Th ird
P arty
N o t su p p o rte d
Comments
Proposer Response
Vendor Control is:
Requirement Implemented by Control Name
CONTROL ENHANCEMENT NAMES (are in caps)
Applicability Location (in relation to Agency)
Software, Firmware, and Information Integrity X
INTEGRITY CHECKS X
INTEGRATION OF DETECTION AND RESPONSE X
Spam Protection X
CENTRAL MANAGEMENT X
AUTOMATIC UPDATES X
Information Input Validation X Error Handling X Information Management and Retention X Memory Protection X Monitoring Policies and Procedures
Assessments X
INDEPENDENT ASSESSORS X
SPECIALIZED ASSESSMENTS X
System Interconnections X
RESTRICTIONS ON EXTERNAL SYSTEM CONNECTIONS X
Plan of Action and Milestones X Authorization X Continuous Monitoring X
INDEPENDENT ASSESSMENT X
X Penetration Testing X
INDEPENDENT PENETRATION AGENT OR TEAM
RED TEAM EXERCISES
FACILITY PENETRATION TESTING X
Internal System Connections X ection Policy and Procedures
Physical Access Authorizations X Physical Access Control X Access Control for Transmission X Access Control for Output Devices X Monitoring Physical Access X
INTRUSION ALARMS AND SURVEILLANCE EQUIPMENT X
Visitor Access Records X Power Equipment and Cabling X
RFP #S-DASOBO-00001233
A ll
M o d e rate
O n P re m ise
O ff P re m ise
A ge n cy
V e n d o r
Sh cy/ve n d o r)
B ase
A d d ‐o n
Th ird
P arty
N o t su p p o rte d
Comments
Proposer Response
Vendor Control is:
Requirement Implemented by Control Name
CONTROL ENHANCEMENT NAMES (are in caps)
Applicability Location (in relation to Agency)
Emergency Shutoff X Emergency Power X Emergency Lighting X Fire Protection X
DETECTION DEVICES AND SYSTEMS X
AUTOMATIC SUPPRESSION DEVICES AND SYSTEMS X
Temperature and Humidity Controls X Water Damage Protection X Delivery and Removal X Alternate Work Site X Location of System Components X ity (Contingency) Procedures
Contingency Plan X
COORDINATE WITH RELATED PLANS X
RESUME ESSENTIAL MISSIONS AND BUSINESS FUNCTIONS X
IDENTIFY CRITICAL ASSETS X
Contingency Training X Contingency Plan Testing X
COORDINATE WITH RELATED PLANS X
Alternate Storage Site X
SEPARATION FROM PRIMARY SITE X
ACCESSIBILITY X
Alternate Processing Site X
SEPARATION FROM PRIMARY SITE X
ACCESSIBILITY X
PRIORITY OF SERVICE X
Telecommunications Services X
PRIORITY OF SERVICE PROVISIONS X
SINGLE POINTS OF FAILURE X
System Backup X
TESTING FOR RELIABILITY AND INTEGRITY X
CRYPTOGRAPHIC PROTECTION X
System Recovery and Reconstitution X
TRANSACTION RECOVERY X
RFP #S-DASOBO-00001233
File details come from the government source that posted it. Updated .