Attachment A.docx

SCDOR - Internal Use

ATTACHMENT A

South Carolina Department of Revenue

2025 Additional Contract Language PII Classification (Personal Identifiable Information)

Disclosure Statement: Terminology Usage For the purposes of this document and related policies, the terms "contractor" and "organization" may be used interchangeably. Both refer to any entity that is engaged in performing services, managing systems, or handling data on behalf of SCDOR, under applicable agreements and compliance obligations. This equivalency shall apply consistently throughout all references in documentation, procedures, and communications unless otherwise specified by context or regulatory guidance.

Table of Contents

GENERAL SECURITY LANGUAGE

1. Contractor, in providing its services, will support SCDOR in its custodianship of information by providing a mechanism for doing business that is proven to be secure. Contractor is required to comply with all applicable laws, regulations of the State of South Carolina, and SCDOR policies, standards, and guidelines (See Addendum A to this SOW) affecting the confidentiality and privacy of SCDOR information. It is the responsibility of Contractor to ensure adherence to new or revised laws, regulations, policies, standards, and guidelines affecting its services or activities. Contractor understands and agrees that compliance with these laws, regulations, policies, standards, and guidelines extends as long as Contractor has possession or control of SCDOR Information notwithstanding the termination date of this SOW. Taxpayer Personal Information is any information sent from SCDOR to Contractor that, which can be used to identify a person who is an end user of SCDOR.

2. Contractor understands and agrees that it will assume liability for any confidentiality breach by its employees and sub-Contractors. Sub-Contractors are only permitted to provide services pursuant to this SOW.

3. Contractor shall have a documented formal security program that addresses the management of security and controls employed within its IT environment and applications. The security program and applications shall be compliant to the National Institute of Standards and Technology Special Publication 800-53, Revision 5 Moderate. IRS Publication 1075 safeguards must be applied when federal tax information is included.

4. Upon suspect of any unauthorized disclosure of SCDOR Information, including breaches and security incidents by an employee, sub-Contractor, or individual working for Contractor, Contractor must notify the following individuals within 24 hours:

Security and Technology Services John EC Davis Chief Information Security Officer 300A Outlet Pointe Blvd.

Columbia, SC 29210 Office: 803-898-5513 mobile: 803-465-6539 Email: Privacy@dor.sc.gov

Internal Audit Caroline Overcash Interim Internal Audit Director 300A Outlet Pointe Blvd.

Columbia, SC 29210 Office: 803-898-3603 mobile: 803-766-9521 Email: Caroline.Overcash@dor.sc.gov

5. The Contractor shall develop and implement a process for ensuring that corrective actions are developed and monitored. The process must include the findings identified during the internal inspections and the remediation plans and dates to resolve these findings. SCDOR must be presented a corrective action plan and approval following and event of any threat or actual use or disclosure of any SCDOR information. See CA-5 of NIST 800-53 Moderate.

6. All data (including non-sensitive information used in daily operations, personnel handbook or call response guidelines) provided to Contractor from SCDOR pursuant to this SOW is classified as confidential, unless otherwise specified by SCDOR.

7. In the event the Contractor’s entity changes its name, or is sold in wholly, in majority, or ownership of the Contractor entity changes, the Contractor will notify SCDOR within 30 days of the official change of ownership date.

8. Vendor/Contractor shall not disclose, publish, or disseminate any information related to this engagement—including but not limited to its existence, scope, deliverables, methodologies, findings, or any reference to SCDOR—without the prior written consent of SCDOR. This prohibition includes public or private communications such as marketing materials, case studies, press releases, or informal discussions.

Vendor/Contractor shall ensure that all employees, agents, subcontractors, and affiliates who may access such information are bound by confidentiality obligations at least as restrictive as those set forth herein. Vendor remains fully liable for any breach of this clause by such third parties.

These confidentiality obligations shall survive the termination, expiration, or completion of this Agreement and remain in effect indefinitely, unless otherwise agreed in writing by SCDOR.

SCDOR SECURITY AND PRIVACY STANDARDS

Contractor agrees to comply with the SCDOR’s Information Security and Privacy Standards. Contractor understands that the SCDOR, from time to time, may update its policies and standards for both employees and Contractors. Contractor understands that a copy of each applicable policy and procedure will be provided. Contractor agrees to comply with the updated policy and standards within six months of notice.

Cloud Computing To use a cloud computing model to receive, process, store, access, protect and/or transmit PII, the organization must comply with all requirements in this publication. The following mandatory requirements are in effect for using cloud services to receive, process, store, access, protect and/or transmit PII:

a. PIII may be deployed within cloud environments that have received authorization through either MS 365 Government Commercial Cloud service of equal or higher classification, or via written approval granted by SCDOR.

b. Onshore Access: Organizations must leverage vendors and services where (i) all PII OR SCDOR INFORMATION physically resides in systems located within the United States; and (ii) all accesses, and support of the systems and services are performed from the United States, its possessions and territories.

c. Physical Description: Organizations and their cloud providers must provide a complete desccription of all data center addresses where PII OR SCDOR INFORMATION will be received, processed, stored, accessed, protected and/or transmitted in their 45-Day notification form.

d. Data Encryption in Transit: PII OR SCDOR INFORMATION must be encrypted in transit within the cloud environment. All mechanisms used to encrypt PII OR SCDOR INFORMATION must be FIPS 140 certified and operate utilizing the latest FIPS 140 compliant module(s). This requirement must be included in the SLA.

e. Data Encryption at Rest: PII OR SCDOR INFORMATION must be encrypted while at rest in the cloud using the latest FIPS 140 certified encryption mechanism. This requirement must be included in the SLA.

Supplemental Guidance: If the organization is able to encrypt data in transit and at rest using the latest FIPS 140 certified solutions and maintain sole ownership of encryption keys, preventing logical access from the cloud service providers, Safeguards will consider this a logical barrier and will allow data types with restrictions Using FIPS 140 certified encryption at rest exempts third-party contractors from some protection requirements such as training and background information requirements.

f. The organization must notify the SCDOR privacy office (privacy@scdor.sc.gov) and receive written approval from SCDOR prior to transmitting PII OR SCDOR INFORMATION into a cloud environment.

g. Service Level Agreements and Contracts: The organization must establish security and privacy controls, based on these requirements, for how PII OR SCDOR INFORMATION is received, processed, stored, accessed, protected and/or transmitted inside the cloud environment. Organizations must provide the requirements through a legally binding contract or SLA with their third-party cloud provider.

h. Data Isolation: Software and/or services that receive, transmit, process or store PII OR SCDOR INFORMATION must be isolated within the cloud environment so that other cloud customers sharing physical or virtual space cannot access other customer data or applications.

i. Risk Assessment: The organization shall perform an annual assessment of information security and privacy controls across all systems that receive, process, store, access, protect, or transmit SCDOR data. These assessments support the identification and analysis of risks—including their likelihood and potential impact—with the ultimate objective of risk mitigation. Assessment approaches may be quantitative, qualitative, generic, internally specific, or dynamic in nature. The chosen assessment type and framework shall be determined based on the classification of data: Confidential and Restricted, Public, or Internal Use.

j. Persistence of Data in Relieved Assets: Storage devices where PII OR SCDOR INFORMATION has resided must be securely sanitized and/or destroyed using methods acceptable by NIST. This requirement must be included in the SLA.

k. Multifactor Authentication: Organizations must implement sufficient multifactor authentication when their cloud solutions are available from the internet (i.e., there is access to the cloud solution from outside of the organization’s trusted network). If the cloud can only be accessed from an organization’s internal network, multifactor authentication must be implemented by organization solution(s) when establishing a remote connection.

l. Security Control Implementation: Customer defined security and privacy controls must be identified, documented and implemented, and must comply with NIST 800-53 Moderate.

SCDOR Security and Privacy Standards Safeguarding information assets is no longer a siloed concern in todays’ evolving hyper-connected and data driven environment. Security and privacy controls standards serves as the foundational framework for ensuing that sensitive information is protected against unauthorized access, disclosure, alteration, and destruction. These standards are most effective when built on a balanced security triad: people, processes, and technology. Supplemental standards of the security and privacy standards below are found in NIST 800-53 Moderate.

Access Enforcement (AC-3) Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

(Defined): Users having accounts with administrator access privileges must access those accounts only from contractually owned or authorized Contractor systems.

(CE-11) Restrict Access to Specific Information Types: Restrict access to data repositories containing SCDOR data.

Separation of Duties (AC-5)

a. Identify and document separate duties of individuals to prevent harmful activity without collusion; and

b. Define system access authorizations to support separation of duties.

Least Privilege (AC-6)

Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned contractual tasks.

Control Enhancements:

(CE-1): Authorize Access to Security Functions: Authorize Access for Security Functions to:

a. Explicitly authorize access to security functions deployed in hardware, software, and firmware; and

b. Security-relevant information.

(CE-2): Non-Privileged Access for Non-Security Functions: Require that users of system accounts or roles with access to security functions including but not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited and setting intrusion detection parameters use non-privileged accounts or roles, when accessing non-security functions.

(Defined): Prohibit accounts with administrative privileges (including local administrator rights) from web browsing and other Internet connections outside of the local protected boundary unless such risk is accepted in writing by the Contractor's CISO.

(Defined): Block accounts with administrative privileges (including local administrator rights) from access to email unless such risk is accepted in writing by the Contractors CISO.

(CE-6): Privileged Access by Non-Contractor Users: Prohibit privileged access to the system by non-Contractor users.

(CE-7): Review of User Privileges

a. Review annually the privileges assigned to SCDOR data to validate the need for such privileges; and

b. Reassign or remove privileges, if necessary, to correctly reflect Contractor mission and business needs.

(CE-8): Privilege Levels for Code Execution: Prevent the following software from executing at higher privilege levels than users executing the software: Contractor-defined software.

(CE-9): Auditing Use of Privileged Functions: Audit the execution of privileged functions.

(CE-10): Prohibit Non-privileged Users from Executing Privileged Functions: Prevent non-privileged users from executing privileged functions.

Remote Access (AC-17)

a. Establish and document usage restrictions, configuration/connection requirements and implementation guidance for each type of remote access allowed; and

b. Authorize each type of remote access to the system prior to allowing such connections.

Control Enhancements:

(CE-1): Monitoring and Control: Employ-automated mechanisms to monitor and control remote access methods.

(CE-2): Protection of Confidentiality and Integrity Using Encryption: Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

(CE-3): Managed Access Control Points: Route remote accesses through authorized and managed network access control points.

(CE-4): Privileged Commands and Access

a. Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: compelling operational needs defined by the Contractor; and

b. Document the rationale for remote access in the security plan for the system.

(CE-9): Disconnect or Disable Access: Provide the capability to disconnect or disable remote access to the system within Contractor-defined time period.

User-Based Collaboration and Information Sharing (AC-21)

a. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for information sharing circumstances where user discretion is required and permitted by contract; and

b. Employ automated mechanisms or manual processes compliant federal standards to assist users in making information sharing and collaboration decisions.

Supplemental Guidance: The Contractor must restrict the sharing/disclosure of SCDOR data to only those authorized in according to contract.

Auditable Events (AU-2)

a. Identify the types of events that the system is capable of logging in support of the audit function:

1. All accesses or attempts to access an SCDOR data system, including the identity of each user and device;

b. Coordinate the event logging function with other Contractor entities requiring audit related information to guide and inform the selection criteria for events to be logged;

c. Specify the following event types for logging within the system: Contractor -defined subset of AU-2a requirements (e.g. Systems capable of required event types relevant to the use or administration of SCDOR data);

d. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and

e. Review and update the event types selected for logging annually or when there is a system change. Document changes in the system security plan.

Content of Audit Records (AU-3)

a. Ensure that audit records contain information that establishes the following:

1. What type of event occurred

2. When the event occurred;

3. Where the event occurred;

4. Source of the event;

5. Outcome of the event; and

6. Identity of any individuals, subjects, or objects/entities associated with the event.

Control Enhancements:

(CE-1) Additional Audit Information: Generate audit records containing the following additional information:

a) Details that facilitate the reconstruction of events if

1. Unauthorized activity occurs or is suspected; or

2. A malfunction occurs or is suspected.

(CE-3) Limit Personally Identifiable Information Elements: Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: Taxpayers Full Name, address, phone number, other names used, employment status, driver’s license number, work address, personal cell phone, spouse information, office phone number, SCDOR ID issued, email address, DOB, Gender, SSN, Age, Taxpayer ID.

Logs of SCDOR data (Electronic and Non-Electronic)

The Contractor must establish a tracking system to identify and track the location of electronic and non-electronic SCDOR data from receipt until it is destroyed. The log may include the following tracking elements:

1. Taxpayer Identifier

2. Tax year(s)

3. Type of information (e.g., tax reports, Form 1040, work papers)

4. The reason for the request

5. Date requested

6. Date received

7. Exact location of it

8. Who has had access to the data

9. If disposed of, the date and method of disposition

To the extent possible, do not include tax information in the log. If tax information is used, the log must be secured in accordance with all other safeguard requirements.

Audit Review, Analysis, and Reporting (AU-6)

a. Review and analyze system audit records weekly for indications of inappropriate or unusual activity and the potential impact of the inappropriate or unusual activity;

b. Report findings to the individual(s) specified within the Contractor’s incident response procedures; and

c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

AU-11: Audit Record Retention Retain audit records seven (7) years to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Identification and Authentication (Contractor Users) (IA-2)

Uniquely identify and authenticate Contractor users and associate that unique identification with processes acting on behalf of those users.

Control Enhancements:

(CE-1) Multifactor Authentication to Privileged Accounts: Implement multi-factor authentication for access to privileged accounts.

(CE-2) Multifactor Authentication to Non-Privileged Accounts: Implement multi-factor authentication for access to non-privileged accounts.

(CE-6) Access to Accounts – Separate Device: Implement multi-factor authentication for remote access to privileged accounts and non-privileged accounts such that:

a. One of the factors is provided by a device separate from the system gaining access; and

b. The device meets Authenticator Assurance Level 2 (AAL) per NIST SP 800-63.

(CE-8) Access to Accounts – Replay Resistant: Implement replay-resistant authentication mechanisms for access to privileged accounts with network access.

Media Access (MP-2)

Restrict access to digital and/or non-digital media containing SCDOR data to authorized individuals.

Media Marking (MP-3)

a. Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and

b. Exempt information media containing SCDOR data from marking if the media remains within Contractor-controlled areas.

Media Storage (MP-4)

a. Physically control and securely store digital and non-digital media containing SCDOR data within Contractor-controlled areas; and

b. Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Media Transport (MP-5)

a. Protect and control digital and/or non-digital media containing SCDOR data during transport outside of controlled areas using Contractor defined safeguards in accordance with secure storage section and SC-28 control requirements;

b. Maintain accountability for system media during transport outside of controlled areas;

c. Document activities associated with the transport of system media; and

d. Restrict the activities associated with the transport of system media to authorized personnel.

Control Enhancements:

(CE-3) Custodians: Employ an identified custodian during transport of system media outside of controlled areas.

SC-28: Protection of Information at Rest

Protect the confidentiality and integrity of the following information at rest:

a. SCDOR data

b. IT System-related information (e.g., configurations, rule sets); Control Enhancements:

(CE-1) Cryptographic Protection: Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of SCDOR data at rest on end user computing systems (i.e., desktop computers, laptop computers, mobile devices, portable and removable storage devices) in non-volatile storage. Implement the following types of cryptography required for each specified cryptographic use: Latest FIPS-140 validated encryption mechanism, NIST 800-52, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations, Encryption in transit (payload encryption). Use of SHA-1 for digital signatures is prohibited.

Control Enhancements:

(CE-1) Review, Approve, Track, Document, and Verify: Review, approve, track, document, and verify media sanitization and disposal actions.

(Defined): Clear or purge any sensitive data from the system BIOS or UEFI before a computer system is disposed of and leaves the Contractor. Reset the BIOS or UEFI to the manufacturer’s default profile, to ensure the removal of sensitive settings such as passwords or keys.

(Defined): Media provided by foreign visitors (end users) may only be loaded into a standalone Contractor system. The system must remain standalone until such time as it is sanitized. Additionally, no other media loaded into the standalone system can be loaded into a non-standalone Contractor system until sanitized.

Transmission Confidentiality & Integrity (SC-8)

Protect the confidentiality and integrity of transmitted information.

Control Enhancements:

(CE-1) Cryptographic Protection: Implement cryptographic mechanisms to prevent unauthorized disclosure of information and detect changes to information during transmission.

Protection of Information at Rest (SC-28)

Protect the confidentiality and integrity of the following information at rest:

a. SCDOR data

b. IT System-related information (e.g., configurations, rule sets);

Control Enhancements:

(CE-1) Cryptographic Protection: Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of SCDOR data at rest on end user computing systems (i.e., desktop computers, laptop computers, mobile devices, portable and removable storage devices) in non-volatile storage.

Information System Monitoring (SI-4)

The organization shall implement continuous information system monitoring capabilities, in alignment with the NIST SP 800-53 Moderate control baseline, to detect anomalies, indicators of attack, and unauthorized activity across its technology environment.

Monitoring solutions must include the following:

- Automated detection tools capable of identifying suspicious behavior, potential security events, and policy violations.

- Event logging and audit trails for system activity, maintained in accordance with federal retention and review guidelines.

- Security Information and Event Management (SIEM) capabilities to correlate and analyze security data in real-time.

- Incident response integration to ensure timely triage, containment, and escalation of detected threats.

Upon request, the organization must demonstrate evidence of monitoring activities through:

- Documented procedures and configurations,

- Audit log reviews and summaries,

- Recorded incident investigations tied to monitoring alerts, and

- Regular reporting on system health and compliance status.

Monitoring shall be tailored to the classification and criticality of organizational assets and data, with heightened scrutiny applied to systems handling Confidential or Restricted SCDOR information.

Media Sanitization The type of sanitization performed depends on whether or not the media will be reused by the organization or leaving organizations control. If the media will or will not be reused by the organization for the same purpose of storing SCDOR data and will not be leaving organization control, follow NIST 800-88 media sanitization standards. Media sanitization refers to a process that renders access to target data on the media infeasible for a given level of effort. This standard will assist the organization and system owners in making practical sanitization decisions based on the categorization of confidentiality of their information.

See also NIST MP-6. Media Sanitization.

Additional Requirements Contractor acknowledges that all work products created specifically and exclusively for the SCDOR under this engagement are the property of the SCDOR and may not be reproduced or used for purposes other than the work of this engagement without express written permission of the SCDOR.

Contractor acknowledges that all data owned by the SCDOR and provided by the SCDOR to Contractor in the course of this engagement is the sole property of the SCDOR. Contractor will not use this data for any purpose other than the work of this engagement, or share the data with any third party, without the express written permission of the SCDOR except on an anonymized or aggregated basis. Contractor will return or destroy any SCDOR data in his/her possession when the engagement is terminated at the SCDOR’s written request.

Contractor acknowledges that SCDOR data is highly confidential in nature, and that confidentiality is protected by force of law.

Contractor agrees to comply with the following State of South Carolina laws:

· S.C. Code Ann. § 12-54-240. Disclosure of records of and reports and returns filed with Department of Revenue by employees and agents of department and SCDOR auditor's office prohibited, penalties.

· S.C. Code Ann. § 39-1-90. Breach of security of business data; notification; definitions; penalties; exception as to certain banks and financial institutions; notice to Consumer Protection Division.

· S.C. Code Ann. § 1-11-490. Breach of security of SCDOR agency data; notification; rights and remedies of injured parties; penalties; notification of Consumer Protection Division.

· Chapter 20, Title 37, S.C. Code of Laws. Consumer Identity Theft Protection.

· Chapter 2, Title 30, S.C. Code of Laws. Family and Personal Identifying Information Privacy Protection.

· Chapter 4, Title 30, S.C. Code of Laws. Freedom of Information Act.

· Chapter 1, Title 30, S.C. Code of Laws. Public Records, Reports and Official Documents.

Contractor agrees to be required to sign a Statement of Confidentiality and Disclosure Requirements which is attached to this SOW and incorporated herein.

Converted Media Conversion of SCDOR data from paper to electronic media (scanning) or from electronic media to paper (print screens or printed reports) also requires tracking from creation to destruction of the converted SCDOR data. All converted SCDOR data must be tracked on logs.

Offshore Operations Access of SCDOR data by a Contractor, employees, agents, representatives, or sub-Contractors located outside of the legal jurisdictional boundary of the United States (outside of the United States, its territories, embassies, or military installations) is prohibited. SCDOR data must not be received, processed, stored, accessed, or transmitted to (IT) systems located offshore nor may SCDOR data be sent offshore for disposal. Systems containing SCDOR data must be located, operated, and maintained by personnel physically located within the United States (this prohibits foreign remote maintenance, foreign call centers, help desks and the like) and should follow NIST Moderate, FedRAMP, including the Background Investigation Requirements in section Background Requirements and Implementation.

Some Contractors may have a need for their employees to travel internationally for business purposes. As such, Contractor must develop procedures to follow during foreign travel. When employees travel abroad, they must not:

· Bring IT equipment containing stored SCDOR data (e.g., laptop computers, tablets, phones, removable media); or

· Access Contractor systems that receive, process, store, protect and/or transmit SCDOR data.

Restricted Access Access to SCDOR data shall be strictly limited to authorized organizational systems, designated organization IP addresses, and approved work locations. The following controls must be enforced to uphold this requirement:

- IP Whitelisting: Only pre-approved static IP addresses associated with secure organizational networks may access SCDOR data.

- System Authorization: Data access shall be restricted to devices that meet organizational security standards and are enrolled in asset management and monitoring systems.

- Geolocation Controls: Access must originate from verified work locations, whether on-premises or officially sanctioned remote sites, with geofencing technologies used where applicable.

- Access Logging and Review: All access attempts must be logged, and deviations from authorized locations or systems shall be flagged for immediate review.

Exceptions to these restrictions must be documented, justified, and approved by SCDOR's Information Security and Compliance leadership.

Care must be taken to deny unauthorized access to areas containing PII OR SCDOR INFORMATION during duty and non-duty hours. This can be accomplished by creating restricted areas, security rooms or locked rooms. Additionally, PII OR SCDOR INFORMATION in any form (computer printout, photocopies, tapes, notes) must be protected during non-duty hours. This can be done through a combination of methods, including secured or locked perimeter, secured area or containerization.

A restricted area is an area where entry is limited to authorized personnel (individuals assigned to the area). All restricted areas must either meet secured area criteria or provisions must be made to store PII OR SCDOR INFORMATION in appropriate containers during non-duty hours. Using restricted areas is an effective method for eliminating unnecessary traffic through critical areas, thereby reducing the opportunity for unauthorized access, disclosure, or theft of PII OR SCDOR INFORMATION. All the following procedures must be implemented to qualify as a restricted area.

Restricted areas will be prominently posted and separated from non-restricted areas by physical barriers that control access. The number of entrances must be kept to a minimum and must have controlled access (e.g., electronic access control, key access, door monitor) to prevent unauthorized entry. The main entrance must be controlled by locating the desk of a responsible employee at the entrance to ensure that only authorized personnel with an official need may enter.

Termination & Exit Requirements

Upon the agreed upon contract termination date, the Contractor will discontinue service under the terms of the SOW in accordance with the conditions listed below. These conditions cannot be voided without express written agreement or withdrawal by SCDOR. Therefore, in consideration of the mutual promises and agreement contained herein, all parties agree as follows:

1. In accordance with agency standards provide SCDOR relevant copies of retained data referenced in the table below. This table only addresses retention for documentation associated with agency safeguard requirements.

2. SCDOR data must be destroyed when there is no longer a need and use for it and in accordance with contract and retention scheduled.

3. Provide attestation of data transfer to the agency.

4. Provide attestation of data destruction.

Contractor shall provide the below elements at least quarterly.

Visitor Access Logs A visitor access log must be maintained at a designated entrance to a restricted area and all visitors (persons not assigned to the area) entering the area shall be directed to the designated entrance.

Prior to accessing areas that contain PII OR SCDOR INFORMATION, a visitor must sign a visitor access log. The security personnel must validate the person’s identity by examining government-issued identification (e.g., state driver’s license or passport). The security personnel must compare the name and signature entered in the access log with the name and signature of the government-issued identification. When leaving the area, the security personnel or escort must enter the visitor’s time of departure.

The visitor access log must require the visitor to provide the following information:

· Name and organization of the visitor

· Signature of the visitor

· Form of identification

· Date of access

· Time of entry and departure

· Purpose of visit

· Name and organization of person visited Each restricted area access log must be closed out at the end of each month and reviewed by management. Visitor access logs must be retained for five (5) years, see Figure 2.

Figure 2 – Visitor Access Log

Visitor Access Log

Access Control List To facilitate the entry of employees/vendor/contractor/non-organization personnel who have a frequent and continuing need to enter a restricted area, but who are not assigned to the area, an Authorized Access List (AAL) can be maintained.

The AAL must contain the following:

· Name of employee/vendor/contractor/non-organization personnel

· Organization or department name

· Name and phone number of the organization POC authorizing access

· Address of organization/vendor/contractor

· Purpose and level of access AAL must be reviewed monthly or upon occurrence or potential indication of an event such as a possible security breach or personnel change.

If there is any doubt of the identity of the individual, the security monitor must verify the identity of the individual against the AAL prior to allowing entry into the restricted area.

For additional guidance, see NIST Control PE-2, Physical Access Authorizations. Also, see NIST Control PE-16, Delivery and Removal, for guidance on controlling information system components entering and exiting the restricted area.

Controlling Access to Areas Containing PII OR SCDOR INFORMATION Management or a designee must maintain an authorized list of all personnel who have access to information system areas, where these systems contain PII OR SCDOR INFORMATION. This does not apply to those areas within the facility officially designated as publicly accessible.

The organization must maintain a policy addressing issuance of appropriate authorization credentials, including badges, identification cards or smart cards. This policy must include proper use and accountability requirements.

In addition, a list must be maintained that identifies those individuals who have authorized access to any systems where PII OR SCDOR INFORMATION is housed. Access authorizations and records maintained in electronic form are acceptable.

Each organization must control physical access to the information system devices that display PII OR SCDOR INFORMATION or where PII OR SCDOR INFORMATION is processed to prevent unauthorized individuals from observing the display output.

The organization or designee must monitor physical access to the information system where PII OR SCDOR INFORMATION is stored to detect and respond to physical security incidents. For additional information, see NIST Control PE-6, Monitoring Physical Access.

For all areas that process PII OR SCDOR INFORMATION, the organization must position information system components within the facility to minimize the opportunity for unauthorized access.

When cleaning and facility maintenance personnel work in restricted areas containing unsecured PII OR SCDOR INFORMATION, those activities must be performed in the presence of an authorized employee.

The organization must establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel. The organization must verify that non-escorted personnel performing maintenance on the system possess the required access authorizations and if not, then the organization must designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities. See NIST MA-5, Maintenance Personnel.

Allowing an individual to “piggyback” or “tailgate” into restricted locations must be prohibited and documented in organization policy. The organization must ensure that all individuals entering an area containing PII OR SCDOR INFORMATION do not bypass access controls or allow unauthorized entry of other individuals. Unauthorized access must be challenged by authorized individuals (e.g., those with access to PII OR SCDOR INFORMATION). Security personnel must be notified of piggyback/tailgate attempts.

Controlling Keys & Combinations All containers, rooms, buildings, and facilities containing PII OR SCDOR INFORMATION must be locked when not in actual use.

Access to a locked area, room or container can be controlled only when the key or combination is controlled. Compromising a combination or losing a key negates the security provided by that lock. Combinations to locks must be changed annually or when an employee who knows the combination retires, terminates employment or transfers to another position.

Combinations must be given only to those who have a need to have access to the area, room or container and must never be written on a sticky-note, calendar pad or any other item (even though it is carried on one’s person or hidden from view). An envelope containing the combination must be secured using the same security measures for the envelope as the locked material.

Access control measures (keys, proximity cards, combinations) must be issued only to individuals having a need to access an area, room, or container. Inventory records must be maintained and must account for the total number of keys, proximity cards, combinations, etc. that are available and issued. The inventory must account for master keys and key duplicates. An annual reconciliation must be done on all key records.

The number of keys or persons with knowledge of the combination to a secured area must be kept to a minimum. Keys and combinations will be given only to those individuals who have a frequent need to access the area.

Locking Systems for Secure Access Access control systems (e.g., badge readers, smart cards, and biometrics) that provide the capability to audit access control attempts must maintain access control logs with successful and failed access attempts to secure areas containing PII OR SCDOR INFORMATION or systems that process PII OR SCDOR INFORMATION. Organization personnel must review access control logs on a monthly basis. The access control log must contain the following elements:

· Owner of the access control device request access

· Success/failure of the request

· Date and time of the request PII OR SCDOR INFORMATION in Transient Handling PII OR SCDOR INFORMATION must be such that the PII OR SCDOR INFORMATION does not become misplaced or available to unauthorized personnel.

Any time PII OR SCDOR INFORMATION is transported from one location to another, care must be taken to provide appropriate safeguards. When PII OR SCDOR INFORMATION is hand-carried by an individual in connection with a trip or in the course of daily activities, it must be kept with that individual and protected from unauthorized disclosures.

Security during Office Moves When it is necessary for an office to move to another location, plans must be made to protect and account for all PII OR SCDOR INFORMATION properly. PII OR SCDOR INFORMATION must be in locked cabinets or sealed packing cartons while in transit. Using sealed boxes serves the same purpose as double-sealing and prevents anyone from viewing the contents. PII OR SCDOR INFORMATION must remain in the custody of an organization employee and accountability must be maintained to ensure that cabinets or cartons do not become misplaced or lost during the move.

Physical Security of Computers, Electronic and Removable Media Computers and electronic media (including telephones using Voice Over Internet Protocol [VOIP]) that receive, process, store, access, protect and/or transmit PII OR SCDOR INFORMATION must be in a secure area with restricted access. Basic security requirements must be met, such as keeping PII OR SCDOR INFORMATION locked up when not in use. When removable media contains PII OR SCDOR INFORMATION, it must be labeled as PII OR SCDOR INFORMATION.

All computers, electronic media and removable media containing PII OR SCDOR INFORMATION must be kept in a secured area under the immediate protection and control of an authorized employee or locked up. When not in use, the media must be promptly returned to a proper storage area/container.

For physical security protections of transmission medium (e.g., cabling), see NIST Control PE-4, Access Control for Transmission.

Offsite Storage Requirements Media containing PII OR SCDOR INFORMATION may not be sent to off-site storage facility without prior written approval from SCDOR.

Storing Data PII OR SCDOR INFORMATION may be stored on hard disks only if organization-approved security access control devices (hardware/software) have been installed, are receiving regularly scheduled maintenance including upgrades and are being used. Access controls must include password security, an audit trail, encryption, virus detection and data overwriting capabilities.

Only organization-approved security access control devices and organization-approved software will be used. Use of illegal and/or non-approved software is prohibited. Electronic media that is to be reused must follow media sanitization requirements.

The organization must maintain a policy for the security of alternative work sites. The organization must coordinate with the managing host system(s) and any networks and maintain documentation on the test. Before implementation, the organization must certify that the security controls are adequate for security needs. Additionally, the organization must develop and disseminate rules and procedures to ensure that employees do not leave computers unprotected at any time. These rules must address brief absences while employees are away from the computer.

Commingling of Data Commingling of PII OR SCDOR INFORMATION refers to having PII OR SCDOR INFORMATION and non-PII OR SCDOR INFORMATION data stored together, regardless of format. For example, commingling occurs when PII OR SCDOR INFORMATION is included in a sentence of text in a paper notice or letter; a row or column containing PII OR SCDOR INFORMATION in a database table; files stored on electronic media where some contain PII OR SCDOR INFORMATION and some do not; or at a shared data center where some systems contain PII OR SCDOR INFORMATION that require access restrictions, and some do not. Any kind of commingling creates the need for additional controls, since the introduction of PII OR SCDOR INFORMATION requires the entire letter, data table, removable media, etc. be handled and protected as PII OR SCDOR INFORMATION.

SCDOR data must remain strictly segregated from non-SCDOR data across all information systems, environments, and repositories. The commingling of SCDOR data with data from external entities, non-authorized sources, or unrelated organizational functions is expressly prohibited.

To enforce this requirement, the organization shall:

- Implement logical and physical data separation within infrastructure, including access controls, virtual environments, and storage systems.

- Enforce role-based access restrictions to ensure that only authorized personnel can handle SCDOR data within designated systems.

- Conduct regular audits and validations of data environments to detect and prevent any unauthorized mixing of datasets.

- Maintain documented controls over data flows, integrations, and processing pipelines that touch SCDOR-related assets.

Any exceptions must be formally reviewed, risk-assessed, and approved in writing by the SCDOR Information Security and Compliance authority.

Commingling of Electronic Media If PII OR SCDOR INFORMATION and non-PII OR SCDOR INFORMATION is recorded on electronic media (e.g., tapes) with other data, it must be protected as if it were entirely PII OR SCDOR INFORMATION. Such commingling of data on electronic media should be avoided.

When data processing equipment is used to process or store PII OR SCDOR INFORMATION and the information is mixed with organization data, access must be controlled by:

· Restricting computer access only to authorized personnel

· Systemic means, including labeling; for additional information, see NIST Control MP-3, Media Marking

· When technically possible, data files, data sets and shares must be overwritten after each use Commingled data at multi-purpose facilities results in security and privacy risks that must be addressed. If the organizations share physical or computer facilities with other organizations, departments or individuals not authorized to have PII OR SCDOR INFORMATION, strict physical and systemic controls must be maintained to prevent unauthorized disclosure of this information.

Background Check Requirements & Implementation Determining the suitability of individuals who require access to SCDOR information, including SCDOR data, is a key factor in ensuring adequate information security. Prior to granting access to SCDOR data and thereafter, the Contractor must complete a suitability background investigation that is favorably adjudicated by the Contractor and to include, at a minimum, the following requirements:

· Contractors must develop a written policy requiring that Contractor’s employees, Contractors, and sub-Contractors (if authorized), with access to SCDOR data must pass a background investigation before allowing access to SCDOR data that is favorably adjudicated. The policy will identify the process, steps, timeframes, and favorability standards that the Contractor has adopted. The Contractor may adopt the favorability standards set by the Federal Investigative Standards (FIS) or one that is currently used by another SCDOR Contractor, or the Contractor may develop its own SCDOR-approved standards for accessing SCDOR data approved by SCDOR.

· The written background investigation policy must establish a result criterion for each required element that defines what would result in preventing or removing a Contractor’s employee’s or, Contractor’s and sub-Contractor’s access to SCDOR data.

· Contractors must initiate a background investigation for all Contractor’s employees, Contractors, and sub-Contractors prior to permitting access to SCDOR data.

· Contractors must ensure a reinvestigation is conducted within five (5) years from the date of the previous background investigation for each employee, Contractor, and sub-Contractor requiring access to SCDOR data.

· Contractors must make written background investigation policies and procedures as well as a sample of completed Contractor employee, sub-Contractor, and sub-Contractor employee background investigations available for inspection upon request.

Background investigations for any individual granted access to SCDOR data must include, at a minimum:

This national Contractor check is the key to evaluating the history of a prospective candidate for access to SCDOR data. It allows the Contractor to check the applicant’s criminal history in all 50 states, including current or known past residences. Contractors must ensure a fingerprint review is conducted within five (5) years from the date of the previous fingerprint investigation for each Contractor employee, sub-Contractor, and sub-Contractor employee requiring access to SCDOR data.

Check of local law enforcement organizations where the subject has lived, worked, and/or attended school within the last five (5) years and, if applicable, for any identified arrests.