Attachment_A_-_Basic_Security.pdf

Kansas Department of Transportation Data Security Attachment

The following provisions shall apply to all successful bidders engaged in the supply of Kansas Department of Transportation (KDOT) herein referred to as “AGENCY”, for the Data Security Attachment, good and/or services. The following provisions will be incorporated into and made part of the contract between Bidder and Agency. By submitting the bid, the Bidder acknowledges that it has the capability to adhere to and will be bound by the following provisions as well as any other terms and conditions outlined in the solicitation.

1. General Statements.

a. Contractor acknowledges that it receives and/or has access to AGENCY computers, communication systems, data, and/or networks for the purposes set forth in the Contract.

Contractor agrees to ensure that any information or data required to be delivered pursuant the Contract shall be delivered through systems and infrastructure approved by AGENCY and shall be consistent with industry best practices pertaining to security. If any data is made available or accessible to Contractor, its employees, agents, or contractors, pertaining to AGENCY’s business or financial affairs, or to AGENCY’s projects or transactions, Contractor will not store, copy, analyze, monitor, or otherwise use that data except for the purposes set forth in the Contract for the benefit of AGENCY.

b. Subject to any other express agreement between the Parties with respect to the Contract, Contractor has implemented and will maintain appropriate technical and organizational measures, internal controls, and information security routines intended to protect AGENCY’s data, services, and infrastructure in its environments or under its control against accidental, unauthorized or unlawful access, disclosure, alteration, loss, or destruction, as set out below.

c. To the extent AGENCY’s data includes personal data, the implementation of and compliance with these measures and any additional security measures set out herein are designed to provide an appropriate level of security in respect of the processing of the personal data and shall at all times comply fully with all applicable laws, regulations, and government orders relating to Restricted-Use Information and data privacy with respect to any such data that Contractor receives or has access to under the Contract or in connection with the performance of any services for AGENCY.

Contractor will otherwise protect Restricted-Use Information and will not use, disclose, or transfer across borders such Restricted-Use Information.

d. Contractor shall, at all times, remain compliant with the privacy and security requirements mandated by federal, state and local laws and regulations. Specifically, Contractor will fully comply with all Kansas statutes, regulations, and policies including the requirements in:

i. K.S.A 75-7244.

ii. S.B. 291 as published in Session Laws as published in Session Laws 2024, ch. 95, eff. July 1,

iii. Applicable Kansas IT policies and standards adopted under the authority of the Kansas Information Technology Executive Council (ITEC), including 7000 Series “Security”

2. Definitions.

a. “Accepted Working Condition” (AWC) is the condition of the application in the Production Environment after the initial use of that application in the Production Environment.

b. “Authorized Personnel” means Contractor’s employees who have a need to know or otherwise access Restricted-Use Information to enable Contractor to perform its obligations under this Contractor.

c. “Change Request” (CR) is any activity that alters the scope, objectives, deliverables, requirements, basic architecture, cost or schedule of the service, solution, or interface system;

or an activity that creates an impact/change to a current application in production, software configuration, or hardware configuration.

d. “Contract” is the legal agreement between AGENCY and the Contractor to which this document is incorporated into.

e. “Criminal Justice Information Services” (CJIS) is data provided to AGENCY by the Federal Bureau of Investigation or the Kansas Bureau of Investigation that includes sensitive information about criminal activities, investigations, and individuals involved in the criminal justice system.

CJIS data shall include but is not limited to: (1) biometric data; (2) identity history data; (3) biographic data; and (4) case history data.

f. “Cybersecurity Incident” shall have the meaning ascribed to it in 75-7244.

g. “Data Center” shall mean a facility physically located in the United States of America where the servers, software, and/or hardware parts of Contractor’s service are located in.

h. “Data Security Incident” means a situation where Aggregator reasonably believes that there has been (1) the loss or misuse (by any means) of Restricted-Use Information, (2) the inadvertent, unauthorized and/or unlawful processing, corruption, modification, transfer, sale or rental of Restricted-Use Information; (3) any other act or omission that compromises the security, confidentiality, or integrity of Restricted-Use Information or (4) any breach of any data protection requirements in relation to the processing of Restricted-Use Information by Contractor any current or former employees of Contractor.

i. “Destroy” means shredding, permanently erasing and deleting, degaussing, or otherwise modifying Restricted Use Information in paper, electronic, or other means so as to make it unreadable, unreconstructible, and indecipherable.

j. “Information Security Incident” includes Data Security Incident and Cybersecurity Incident as defined in this Attachment. Information Security Incident does not include unsuccessful access attempts or similar events that do not compromise the security or privacy of the Supplier’s systems, including pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

k. “Information System” is a set of components, including hardware, software, data, people, and processes, that work together to collect, store, process, and distribute information.

l. “Non-Production Data” is data used for testing, development, or training, and not for live business operations or real users. Non-Production Data includes but is not limited to anonymized or sample data that does not contain Restricted-Use Information.

m. “Personal Financial Information” (PFI) is any non-public personally identifiable financial information that an entity collects about an individual in order to provide a financial product or service.

n. “Personally Identifiable Information” (PII) is any information that can be used on its own or with other information to identify or locate a single person. PII shall include but not be limited to a person’s social security number (SSN), passport number, driver's license number, taxpayer identification number, patient identification number, and financial account or credit card number.

o. “Production Data” is any data, including but not limited to information, figures, statistics, records, documents, or results, derived directly or indirectly from a Production Environment. This may include data from a development environment where it originates from or current/historic data from a Production Environment.

p. “Production Environment” is the operational environment in which a software application or system is deployed and used by end users to perform their intended tasks.

q. “Protected Health Information” (PHI) is any information, in any form or medium, held or transmitted, about health status, provision of health care, or payment for health care that is created or collected by a covered entity or the business associates of a covered identity and can be linked to a specific individual.

r. “Restricted-Use Information” (RUI) includes CJIS, PFI, PII, and PHI as defined in this Attachment.

s. “Vulnerability Scan” is the process of identifying weaknesses in information system components that could be used to compromise networks, systems, databases, or applications. Vulnerability scanning includes but is not limited to scanning for patch levels, scanning for functions, ports, protocols, and services that should not be accessible to users or devices, and scanning for improperly configured or incorrectly operating information flow control mechanisms.

3. Security Governance.

a. Security Awareness and Training. Contractor shall maintain an effective information security awareness, training, and education program, informing all employees, subcontractors, and other relevant parties of their information security obligations. Contractor shall have an information security policy that is communicated to and available to its staff. Contractor shall ensure that employees and subcontractors involved in the Contract maintain a requisite level of competence in the relevant information security systems technology. Determination of requisite level of competence shall be in AGENCY’s discretion and shall satisfy the following minimum standards:

i. Contractor’s information security systems awareness training must meet the minimum requirements for IT security procedures and State of Kansas, Kansas Information Technology Executive Council (ITEC), Office of Information Technology Services (OITS) and AGENCY policies, statutes and standards including ITEC 7000 Series.

ii. At the execution of the Contract and, thereafter, upon receipt of any written request by AGENCY, Contractor shall provide Contractor’s information security policy, evidence of the security awareness, training, and education program to AGENCY, and a letter warranting all of Contractor’s employees, and any other individuals acting on behalf of Contractor or under Contractor’s direction, successfully completed Health Insurance Portability and Accountability Act (HIPAA) and IT security awareness training prior to accessing AGENCY data. The letter shall also provide details of the of topics the training employees have completed.

If Contractor’s training does not meet the requisite level of competence requirements as determined by AGENCY, employees of the vendor will be required to complete the AGENCY Vendor IT Security Training before access is granted to AGENCY data.

b. Security Roles and Responsibilities. If providing a service, solution, software, data hosting, or an interface to AGENCY, Contractor shall:

i. Define, and document roles and responsibilities related to information security for the service, solution, software, data hosting, or interface;

ii. Implement user identification and access controls designed to limit access to users in accordance with the principles of least privilege;

iii. Ensure that all personnel with physical or logical access to the service, solution, software, data hosting, or interface will receive industry standard annual security awareness training;

iv. Maintain documentation regarding roles and responsibilities related to information security for the service, solution, software, or interface and review and update this document at least once per year; and

v. At the execution of the Contract and, thereafter, upon receipt of any written request by AGENCY, Contractor shall provide such documentation to AGENCY.

c. Change Management. Contractor shall ensure that all changes to proposed services, solutions, or interfaces are authorized according to change management policies. Contractor will maintain the service, solution, or interface in the AWC with respect to the version of all related hardware/software that may affect the service, solution, or interface. Contractor is not obligated to upgrade service, solution, or interface to meet upgrades of any hardware/software made by AGENCY unless a CR is completed. All project deliverables formally approved or baselined will be governed by a change management request to be approved by the Parties. Contractor will maintain a development environment that will allow them to provide modifications to the service, solution, or interface as demonstrated in the AWC. An impact analysis and other testing shall be conducted before software is installed or changes are put in production. Results of the impact analysis and testing shall be orderly documented.

4. Physical & Environmental Security. Contractor shall support physical and environmental security measures, including securing data on a secure server, in locked data cabinets within a secure facility located within the United States of America. Contractor shall adhere to the following:

a. All AGENCY data must be contained in secure, environmentally controlled Data Centers located in the United States of America. Data Centers shall be owned, operated, and controlled by Contractor. If the Data Center is not owned, operated, and controlled by Contractor (including leased facilities), then Contractor must receive AGENCY approval in writing for Contractor’s use of alternate Data Centers. Contractor will identify and notify AGENCY of the locations of all Data Centers used to host AGENCY data. Contractor shall ensure that all AGENCY data is always stored, processed, and maintained within the United States of America. Contractor shall further ensure that no AGENCY Data is accessed by Contractor’s employees, contractors, or any other individuals under Contractor’s control from outside of the United States.

b. Data Centers must implement physical environmental controls that mitigate or prevent damage from water, fire, temperature, and humidity for Information Systems that process, store, or transmit RUI. Contractor must ensure sufficient power protection is available for critical Information Systems to perform an orderly shutdown.

c. Contractor must restrict physical access to Data Centers that process, store, or transmit RUI to Authorized Personnel only. Contractor must maintain a list, which shall be reviewed and updated as user access privileges change or at least annually, of all Authorized Personnel with physical access to Data Centers that process, store, or transmit RUI. Contractor must require Authorized Personnel to authenticate themselves prior to entry to Data Centers that process, store or transmit RUI. If Contractor allows visitors to Data Centers that process, store or transmit RUI, then visitors must always be escorted by Authorized Personnel. Contractor must log all visitor access to Data Centers that process, store or transmit RUI.

5. Data Security & Management.

a. Contractor shall at all times implement and maintain physical, electronic and organizational security measures in accordance with the best practices and highest industry standards to protect

AGENCY’s data, materials, and any deliverables against any unauthorized access, use, destruction, loss, disclosure, or improper alteration.

b. Contractor shall ensure Contractor’s Data Center and/or cloud environment is secure with industry standard encryption techniques that meets all legal requirements for data stored at rest and in transit. Contractor shall ensure Secure Socket Layers (SSL) configuration per industry best practices, session, and port management.

c. Contractor shall ensure that external connections incorporated into the Data Center and/or cloud have appropriate security controls including industry standard intrusion detection and countermeasures that will detect and terminate any unauthorized activity prior to entering the firewall maintained by Contractor. Contractor shall ensure that the Data Center will utilize industry standard firewalls regulating all data entering the internal data network from any external source which will enforce secure connections between internal and external systems and will permit only authorized data to pass through.

d. Contractor shall utilize industry standard malware protection, incorporating both signature and non-signature-based detection mechanisms, on all systems with access to AGENCY data. Contractor shall ensure that malware protection will be centrally managed and receive regular automatic updates to malicious code protection mechanisms and data files.

e. Contractor shall ensure that any service, software, solution, data hosting, or an interface is capable of auditing the following events: (1) successful and unsuccessful account logon events; (2) account management events; (3) object access; (4) policy change; (5) privilege functions; (6) process tracking and system events; (7) all administrator activity; (8) authentication checks; (9) authorization check; (10) data deletions; (11) data access; (12) data changes; and (13) permission changes.

f. Contractor shall ensure that the service, software, solution, data hosting, or interface employs automated mechanisms to centrally review, analyze and correlate audit and log records from multiple components of the service, software, solution, data hosting, or an interface to support organizational processes for investigation, alerting and response to suspicious activities.

Contractor shall ensure that the service, software, solution, data hosting, or interface supports exporting of log files to AGENCY for review and analysis.

g. Contractor will maintain a complete asset inventory of its infrastructure, network, applications, and cloud environments. Contractor will also maintain an inventory of all its media on which AGENCY’s data is stored. Access to the inventories of such media will be restricted to that Parties’ Authorized Personnel.

h. Contractor shall provide and maintain a backup of AGENCY data that can be recovered in an orderly and timely manner within a predefined frequency consistent with recovery time and recovery point objectives. Contractor shall store a daily incremental and weekly full back backup of AGENCY’s data within the United States of America. Contractor will maintain a disaster recovery plan. At the execution of the Contract and upon written request by AGENCY, Contractor shall provide such plan to AGENCY.

i. Contractor shall implement a contingency plan designed to maintain the access to AGENCY data and to prevent the unintended destruction or loss of data. The contingency plan should provide a predefined frequency, consistent with recovery time and recovery point objectives for disaster recovery and archival purposes of AGENCY data at a secure facility located within the United States of America.

j. Contractor shall ensure that all AGENCY Production Data remains in the United States of America.

Contractor shall further ensure no Production Data is accessed by Contractor employees, contractors, or any other authorized individual located outside of the United States.

k. Contractor shall ensure that all AGENCY Non-Production Data remains in the United States of America. Contractor shall further ensure no Non-Production Data is accessed by Contractor employees, contractors, or any other authorized individual located outside of the United States.

l. If applicable, upon completion, termination, or expiration of the Contract, or at the request of AGENCY, Contractor shall promptly return all media supplied by AGENCY, accompanied by a letter which certifies all private and/or confidential data and software supplied by AGENCY have been removed from all Contractor’s equipment, files, and backup. Contractor shall also dispose of any data in accordance with Paragraph 8.

m. In the event the Contractor ceases doing business, dissolves, ceases to provide all services as defined in the Contract, makes a general assignment for benefit of creditors, has a receiver appointed for any reason, suffers a foreclosure, attachment or levy on any significant business assets, admits its inability to pay debts as they mature or becomes the debtor in any bankruptcy proceeding, the Parties agree to enter into a separate statement of work at a negotiated rate for all work performed in connection with a data migration project to migrate AGENCY’s data. Both Parties agree to negotiation of the separate statement of work in good faith. Should Contractor fail to abide by the terms of this paragraph and not enter a separate statement of work, AGENCY reserves the right to obtain all of AGENCY’s data that AGENCY or its affiliates have created, store, uploaded, and or modified within thirty (30) days of notification and at no cost to AGENCY.

6. Data Privacy.

a. Contractor will implement and maintain a written information security program that contains appropriate security measures to safeguard the RUI of AGENCY’s data that the Contractor receives, stores, maintains, processes, or otherwise accesses in connection with the provision of services hereunder.

b. Contractor shall not disclose to any other person, firm, or corporation or entity (other than to AGENCY) or use for its own benefit, except as provided in the Contract, any data and/or confidential information it receives from AGENCY. Contractor shall return any and all data furnished by AGENCY and its affiliates within 30 days of the request of AGENCY in whatever form(s) it is maintained by Contractor. On the termination of the Contract, Contractor will not use any of such data or any material derived from the data for any purpose and will destroy such data or material except as otherwise expressly stated by this attachment or the Contract. In the event Contractor discloses any of AGENCY’s proprietary and/or RUI, AGENCY may immediately terminate the Contract and pursue legal action recourse. The restrictions and obligations contained herein shall continue in perpetuity from the date of the Contract unless AGENCY provides a written release to Contractor.

c. Except to the extent the information is proven to be publicly known through no breach or misappropriation, and except to the extent a statute, rule or regulation requires AGENCY to make information publicly available, all software, documentation, interfaces and other components of the service provided by Contractor is confidential information of Contractor, and may not be disclosed or used by AGENCY, except solely for its own internal business purposes.

7. Information Security Incidents.

a. Contractor shall maintain an incident response program that implements incident handling for information security incidents that includes preparation, detection and analysis, containment, eradication, and recovery processes. The incident response program must have the capability to support automated mechanisms for supporting incident handling processes.

b. Contractor is responsible for all Information Security Incidents that is processed by, or on behalf of, Contractor. Contractor shall immediately notify AGENCY (within twelve hours) in writing whenever

Contractor reasonably believes that there has been an Information Security Incident. After providing such notice, Contractor will investigate the Information Security Incident, and immediately take all necessary steps to eliminate or contain any exposure of RUI and keep AGENCY advised of the status of such Information Security Incident and all matters related thereto. Contractor further agrees to provide, at Contractor’s sole cost, reasonable assistance and cooperation requested by AGENCY, in the furtherance of any correction, remediation, or investigation of any such Information Security Incident and/or the mitigation of any damage, including any notification required by law or that AGENCY may determine appropriate to send to individuals impacted or potentially impacted by the Information Security Incident. In addition, within a reasonable time frame of identifying or being informed of an Information Security Incident, Contractor shall develop a plan and submit to AGENCY for review a plan that reduces the likelihood of a recurrence of such Information Security Incident.

c. Contractor agrees to adhere to all Information Security Incident reporting in accordance with K.S.A.

75-7244, including utilizing the Incident Reporting Form on the Kansas Office of Information Technology Services website.

8. Destruction of Data. Unless otherwise specified in the Contract, Contractor agrees that upon termination of the Contract or upon request by AGENCY, Contractor shall erase, destroy, and render unrecoverable all AGENCY and AGENCY affiliate data and certify in writing that these actions have been completed within a time frame communicated to Contractor by an authorized agent of AGENCY.

At a minimum, media sanitization is to be performed according to the standards enumerated by the National Institute of Standards, Guidelines for Media Sanitization Special Publication 800-88r1.

Records of all sanitizations involving AGENCY data shall maintained for five (5) years. In the case that any data must be retained for Federal Reporting purposes beyond the termination of the Contract, the Parties shall arrange for the proper transfer, storage, archiving and schedule for deletion of such data.

9. Vulnerability Scans & Security Audit.

a. Contractor shall conduct Vulnerability Scans on networks, systems, databases, or applications that create, maintain, process, transmit, or store data hosting AGENCY RUI on a regular basis (no less than every thirty days). Contractor shall perform quarterly Vulnerability Scans using an Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) and shall provide AGENCY with the results of those scans.

b. If a Vulnerability Scan identifies vulnerabilities in Contractor’s networks, systems, databases, or applications, Contractor is expected to remediate them or, in the rare cases where that is not possible, implement approved and documented compensating controls to reduce risk. In cases where a vulnerability introduces heightened risk to data exposure, AGENCY may disconnect, disable and/or block the device from accessing AGENCY systems until remediation or risk mitigation takes place.

c. Contractor shall ensure performance of a security audit at least once annually.

10. Generative AI. Contractor shall comply with the State of Kansas Generative Artificial Intelligence (AI) Policy (Memorandum No. P8200.00).

a. Contractor shall ensure that responses generated from generative AI outputs shall be reviewed by knowledgeable human operators for accuracy, appropriateness, privacy, and security before being acted upon or disseminated.

b. Contractor shall ensure RUI or any other confidential AGENCY data shall not be utilized in generative AI queries or for building or training proprietary generative AI programs unless explicitly approved by AGENCY with consultation from the Chief Information Security Officer.

c. At the execution of the Contract, Contractor shall disclose Contractor’s utilization of generative AI or integrations with Generative AI platforms. Contractor shall immediately notify AGENCY of any updates to Contractor’s systems that would change Contractor’s use of generative AI. If Contractor is utilizing Generative AI to build software explicitly for the State of Kansas, Contractor must demonstrate positive control over all data input into the system. Contractor shall annotate all usage of software code generated by generative AI.

11. AGENCY Audit. In addition to any documents outlined in this Appendix, upon AGENCY’s reasonable written request with no less than thirty (30) days’ notice during the term of the Contract, the Contractor agrees to cooperate and assist AGENCY with information security audits regarding the Contractor’s compliance with the terms and conditions regarding information security hereunder. This cooperation shall include, but not be limited to:

a. Providing evidence of certification, policies, training and awareness program, and compliance related to information security;

b. Making available to AGENCY the Contractor’s Service and Organization Controls (SOC) 2;

c. Making available to AGENCY the Contractor’s NIST 800-53;

d. Making available to AGENCY an executive summary of the Contractor’s most recent information security tests, including remedial actions taken;

e. Providing evidence of a comprehensive continuous monitoring program encompassing all systems with access to AGENCY data; and

f. Permitting AGENCY to review the Contractor’s information security program, including results of vulnerability scanning.