Attachment 5 - State Security Requirements.docx

Attachment 5 State Security Requirements Actuarial Analysis and Consulting Services Attachment 5 State Security Requirements Department of Healthcare and Family Services BidBuy #26-478HFS-MEDPR-B-52728:|Agency Reference Number: 2026-36-001

The following requirements are specific to systems hosted in a Vendor cloud environment or for a Vendor-managed system hosted in the State of Illinois data center.

A. Vendor will notify the Agency’s Chief Privacy Officer within 24 hours of knowledge of any information breach or other potential security incident which impacts or may impact State of Illinois data. Email notification to: HFS.Privacy.Officer@illinois.gov and Subject Line should state “Security Breach Notification.”

B. Vendor shall have a documented security incident policy and plan. Vendor must supply a copy at the request of the State of Illinois.

C. Any use of artificial intelligence shall comply with all then-current State rules, policies, and/or guidelines for acceptable use of artificial intelligence.

D. Vendor must comply with all United States Federal and State of Illinois laws, rules, and regulations.

E. Vendor must comply with all of the State of Illinois Enterprise Security Policies (https://doit.illinois.gov/initiatives/cybersecurity/policies.html).

F. Vendor must ensure that all information technology, including electronic information, software, systems and equipment, developed or provided under this contract complies with the applicable requirements of the Illinois Information Technology Accessibility Act Standards as published at (www.dhs.state.il.us/iitaa). 30 ILCS 587. If available, Vendor must provide the State of Illinois their most recent Voluntary Product Accessibility Template (VPAT).

G. Vendor program and project management personnel must ensure coordination of activities with the State of Illinois governance program. Vendor must comply with all policies, standards, and procedures defined by the State of Illinois Department of Innovation and Technology’s Enterprise Portfolio Management Office. https://doit.illinois.gov/initiatives/cybersecurity/policies.html

H. Vendor’s system must interface with the State of Illinois’ identity and access management solutions if authentication is required for access to the system.

I. Vendor’s system must log activity within the system and have capacity to forward log information to the State of Illinois’ security incident and event management system (SIEM). Vendor must meet the State of Illinois’ Minimum Logging Requirements for the term of the Contract.

I.1. (See Security Appendix S1)

J. System and Organization Controls (SOC) 1 Report Vendor shall certify it has undergone an independent third-party audit in accordance with Statement on Standards for Attestation Engagements Certification and must provide the State with System and Organization Controls 1, Type 1 (SOC 1, Type 1) report at initial implementation and System and Organization Controls 1, Type 2 (SOC 1, Type 2) report annually thereafter with applicable Bridge/Gap letter.

(If Vendor currently undergoes SOC 1 Assessments: Within 90 days after contract execution and annually thereafter, Vendor shall provide SOC 1 Type 2 audits along with any Bridge/Gap letters that have been completed within the last year.)

K. System and Organization Controls (SOC) 2 Report Vendor shall certify it has undergone an independent third-party audit in accordance with Statement on Standards for Attestation Engagements Certification and must provide the State with System and Organization Controls 2, Type 1 (SOC 2, Type 1) report at initial implementation and System and Organization Controls 2, Type 2 (SOC 2, Type 2) report annually thereafter with applicable Bridge/Gap letter. The SOC 2 Type II report shall cover all five (5) trust principles: i.e., Security, Privacy, Confidentiality, Availability and Processing Integrity.

If Vendor currently undergoes SOC 2 Assessments: Within 90 days after contract execution and annually thereafter, Vendor shall provide SOC 2 Type 2 audits along with any Bridge/Gap letters that has been completed within the last year.

L. Vendor must participate in an annual risk assessment and data classification and system categorization process. The formal risk assessment will be administered by the State of Illinois.

M. Vendor must provide a Plan of Action and Milestones (POA&M) to the State of Illinois that addresses any control deficiencies identified during the State of Illinois’ risk assessment, review of Vendor’s SOC report(s), third-party assessment, and internal security controls assessment. The POA&M should describe the deficiencies in the security controls, address the residual risk, and detail plans for remediation. Vendor must provide the State of Illinois monthly updates regarding progress toward remediation of identified deficiencies.

M.1. (See Security Appendix S2)

N. Vendor must complete and provide the State of Illinois an Authority to Operate (ATO) or Authority to Connect (ATC) packet at the State of Illinois’ request. This packet must be renewed annually.

N.1. (See Security Appendix S3)

O. Vendor must ensure all hosted data pertinent to this contract shall remain located within the contiguous United States.

P. Vendor must ensure encryption of State of Illinois data at rest and in motion. This encryption must comply with encryption security controls as defined in the most current version of the Federal Information Processing Standard (FIPS) 140 using Advanced Encryption Standard (AES) encryption with a minimum key length of 256 bits. Vendor must provide proof of encryption. Vendor must provide the State of Illinois with the capabilities to manage encryption keys for data at rest.

Q. Vendor must store data in a non-proprietary, readily accessible format, or Vendor must provide a solution, at no additional cost to the State of Illinois, to extract any State of Illinois data stored in Vendor’s solution.

R. Vendor must only use State of Illinois data for the purposes stated in this contract.

S. Vendor must maintain a robust and reliable data backup system. Vendor must supply a description of backup methodology, and this methodology must meet defined Maximum Tolerable Downtime (MTD) and Return to Operations (RPO) requirements.

T. Vendor must provide a written disaster recovery methodology and provide proof of annual disaster recovery testing, including issues discovered and remediation plans for the issues discovered.

U. Vendor may not use any State of Illinois data in any non-production system or in any other system outside the application/service procured under this contract.

V. Vendor must provide a copy of all State of Illinois data (in a non-proprietary format) to the State of Illinois without delay upon request by the State of Illinois.

W. Vendor must provide a copy of all State of Illinois data (in a non-proprietary format) to the State of Illinois prior to termination of contract.

X. Vendor must sanitize all media that contains or contained State of Illinois data. Vendor must use the most current revision of NIST Special Publication 800-88, Guidelines for Media Sanitization. Vendor must provide the State of Illinois with a written certification of media sanitization including the method, date and time.

Y. Vendor must use a form of “crypto shredding” acceptable to the State of Illinois for rendering all State of Illinois data hosted by the Vendor inaccessible after a copy of all data has been provided to the State of Illinois.

Z. Vendor and/or its agents must not resell nor otherwise redistribute information gained from its access to the State of Illinois data.

AA. Vendor must not engage in nor permit its agents to push adware, software, or marketing not explicitly authorized by the State of Illinois.

AB. Separate from the assessments required of the Vendor, the Vendor must also allow the State of Illinois to perform vulnerability assessments.

AB.1. (See Security Appendix S4)

AC. Vendor must immediately remediate critical, high, and medium vulnerabilities within the application that are detected during the security assessments and are determined by the State of Illinois to pose an unacceptable risk.

AD. Vendor must secure independent third-party penetration testing at regular intervals, in accordance with Cloud Security Alliance (CSA) and Open Web Application Security Project (OWASP) recommendations. Vendor must supply the results of the testing to the State of Illinois upon request.

AE. Vendor must supply a list of all non-proprietary/open-source software used in their solution. Vendor must also include the version and Open-Source Initiative (OSI) approved license type used for any open-source software. If Open Source uses non-OSI approved licensing Vendor must include licensing terms and conditions.

Security Appendix S1 – Minimum Logging Requirements A. Input validation failures (e.g., protocol violations, unacceptable encodings, invalid parameter names and values) B. Output validation failures (e.g., database record set mismatch, invalid data encoding) C. Authentication successes and failures D. Authorization (access control) failures E. Session management failures (e.g., cookie session identification value modification) F. Application errors and system events (e.g., syntax and runtime errors, connectivity problems, performance issues, third-party service error messages, file system errors, file upload virus detection, configuration changes) G. Application and related systems start-ups and shutdowns, and logging initialization (starting, stopping, or pausing) H. Use of higher-risk functionality (e.g., network connections, addition or deletion of users, changes to privileges, assigning users to tokens, adding or deleting tokens, use of systems administrative privileges, access by application administrators, all actions by users with administrative privileges, access to payment cardholder data, use of data encrypting keys, key changes, creation and deletion of system-level objects, data import and export including screen-based reports, submission of user-generated content - especially file uploads) I. Legal and other opt-ins or opt-outs (e.g., permissions for mobile phone capabilities, terms of use, terms & conditions, personal data usage consent, permission to receive marketing communications)

Security Appendix S2 - Plan of Actions and Milestones Template

Security Appendix S3 – Authority to Operate / Authority to Connect PacketSTATE OF ILLINOIS NIST and FISMA Compliance Document Project Name:

Date:

Duration of Project:

Vendor Name:

Vendor Contact Information:

A. The departments and agencies within all branches of the Federal Government are required by Federal Information Security Modernization Act (FISMA) of 2014 to comply with OMB E-GOV guidance to provide information security for the information and information systems that support the operations and assets under their control. The Federal Office of Management and Budget (OMB) has published guidance for the executive branch in OMB Circulars A-123, Appendix D and A-130.

B. STATE OF ILLINOIS recognizes that FISMA compliance, effective information security management, and continuous monitoring of information systems are paramount to the success of information technology (IT) systems. In order to establish an information security program in accordance with FISMA, Vendor must follow the National Institute for Standards and Technology (NIST) Guidelines of the NIST Risk Management Framework (RMF), as amended.

C. Requirements

(1) Vendor shall provide the following System Security and Privacy Plan (SSPP):

The Vendor must develop a SSPP using the guidance from NIST Risk Management Framework (RMF) (NIST SP 800-18) to establish an information security program in accordance with the Federal Information Security Management Act (FISMA) and demonstrate compliance.

This SSPP must be approved by an authorizing official within the STATE OF ILLINOIS. The SSPP must include, but shall not be limited to, the following:

i. Description of how the system is to be compliant with all the United States Federal and State of Illinois laws regarding the security and privacy of medical data and records and of all protected health information (PHI), including:

a. The Code of Federal Regulations (at 45 CFR 95.621), which provides that State of Illinois agencies are responsible for the security of all automated data processing systems involved in the administration of Department of Health and Human Services’ programs, and which includes the establishment of a security plan that outlines how software and data security will be maintained. This section further requires that State of Illinois agencies conduct a review and evaluation of physical and data security operating procedures and personnel practices on a biennial basis.

b. The security and privacy standards contained in Pub. L. 104–191, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and adopted in 45 CFR Part 164, Subparts C and E, as follows: The security standards require that measures be taken to secure protected heath information that is transmitted or stored in electronic format. The privacy standards apply to protected health information that may be in electronic, oral, and paper form.

c. The requirements in section 1902(a)(7) of the Social Security Act (the Act), as further interpreted in Federal regulations at 42 CFR 431.300 to 307.

ii. Description of measures to secure data and software;

iii. Description of how data is encrypted in transit and in storage;

iv. Description of physical and equipment security measures;

v. Description of personnel security;

vi. Description of software used for security;

vii. Description of the user roles and the access capabilities of each role;

viii. Description of how users are assigned certain roles;

ix. Identification of the staff responsible for controlling the system security;

x. Description of contingency security procedures during a disaster recovery event;

xi. Description of how Vendor works with Office of the Statewide Chief Information Security Officer to conduct annual security review;

xii. Description of how Vendor will ensure password security

xiii. Audit trails for all data access;

xiv. Acknowledgement that Vendor will be responsible for all costs associated with Identify theft, resulting from security breach.

D. Security Risk Assessment. STATE OF ILLINOIS or an independent entity will perform a security control assessment. STATE OF ILLINOIS will provide Vendor a copy of the approved security control assessment. Once Vendor receives the approved assessment, Vendor must then develop a Security Risk Assessment based on the applicable security controls. Guidance on conducting and documenting the Security Risk Assessment can be obtained in NIST SP 800-30.

E. Plan of Action and Milestones (POA&M). After STATE OF ILLINOIS reviews and approves the Security Risk Assessment, Vendor should begin to develop a POA&M. The POA&M should be a living document that is based on the findings and recommendations of the security assessment report. The POA&M should describe the deficiencies in the security controls, address the residual risk, and detail plans for remediation and identify timeline for such remediation.

F. Authorization Approval Package.

(1) After STATE OF ILLINOIS reviews and approves the POA&M, Vendor must prepare a transmittal letter to request approval of the entire authorization package. The authorization package must include at a minimum the following documents:

i. Transmittal Letter

ii. Updated System Security Plan

iii. Security Assessment Plan (include the STATE OF ILLINOIS/independent security assessment)

iv. Security Assessment Report (include the STATE OF ILLINOIS/independent security assessment)

v. Security Risk Assessment

vi. Plan of Action and Milestones

vii. Supporting Documentation including but not limited to design documentation, “As Built” documentation, operational documentation, validation documentation, prior authorization documentation, and other artifacts associated with the implementation and monitoring of the security controls.

a. The authorizing official will determine the risk to the organizational operation and determine if the system is authorized to proceed. The authorizing official will deliver to Vendor a letter of authorization specifying any limitations or restriction placed on the operation of the system. Additionally, this letter should establish an end date for the security authorization.

b. If the authorizing official denies the authorization, STATE OF ILLINOIS will continue to work with Vendor until an acceptable level of residual risk for the system is achieved. This work should include the continued remediation listed in the POA&M.

G. Life-Cycle Management. Vendor shall perform security system reviews and reauthorization of the system at the direction of STATE OF ILLINOIS. Vendor shall be responsible for meeting the following requirements:

(1) Performing continuous monitoring of the security system. Vendor’s continuous monitoring must include periodically selecting a subset of the baseline controls for assessment. Based on assessment of these controls, subsequent remediation actions must be identified and implemented. The ongoing remediation process should include updating key documents such as the SSPP, SAR, and POA&M.

(2) Prior to any system or environmental modifications, Vendor must perform a security impact analysis. This must be included as a part of any change management or configuration management process. If the results of the modification indicate changes to the security posture of the system, corrective actions should be initiated, and appropriate documents revised and updated. The updating of the documentation and continuous monitoring should provide near real-time risk management.

(3) A monthly Security Status Report must be produced by Vendor for STATE OF ILLINOIS. The Security Status Report should provide essential information regarding the security posture of the system as well as the effectiveness of the controls deployed. Ongoing monitoring activities should be detailed as well as ongoing remediation efforts to address known vulnerabilities. Additional guidance for the monitoring of system security can be obtained in NIST SP 800-137.

Security Appendix S4 – Vulnerability Assessment

A. Vendor must obtain approval on behalf of the State of Illinois to perform vulnerability assessments on the cloud-hosting vendor’s website(s).

B. Vendor must work in conjunction with the State in executing the State of Illinois Vulnerability Scanning Agreement prior to the vulnerability assessment. The State would be considered the client within the Scanning Agreement. The Vendor is providing the system on behalf of the State. (See DoIT Scanning Agreement)

C. State of Illinois may, with reasonable notice to Vendor, conduct a security assessment of Vendor’s solution, which may include the following:

(1) Prior to initial “official” production role out of the application,

a. Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application

b. Manual verification of scan results with the same credentials

c. Manual testing of the application for vulnerabilities

d. State of Illinois will not conduct any Denial of Service (DOS) attacks

e. State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)

(2) On a quarterly basis for the for the first year after initial production deployment,

a. Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application

b. Manual verification of scan results with the same credentials

c. Manual testing of the application for vulnerabilities

d. State of Illinois will not conduct any DOS attacks

e. State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)

(3) Prior to any enhancements or upgrades being deployed to production after the initial “official” production role out of the application,

a. Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application

b. Manual verification of scan results with the same credentials

c. Manual testing of the application for vulnerabilities

d. State of Illinois will not conduct any DOS attacks

e. State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)

f. Monthly vulnerability scan – no whitelisting, non-credentialed scan (same day every month) DoIT Scanning Agreement image1.jpg