The file's text, extracted by GovTribe without its formatting.
Attachment A – State Standard Security Requirements
STATE OF ILLINOIS
Illinois Gaming Board Attachment A — SECURITY REQUIREMENTS Central Communications System Procurement BidBuy Reference Number: B45047
State of Illinois RFP V.24.3 1
SECURITY REQUIREMENTS
This document is an attachment to the Request for Proposal (RFP) for the Illinois Gaming Board (IGB), for the procurement of a Central Communication System (CCS). It provides a detailed overview of the Standard Security Requirements for the CCS RFP. The Offeror must read and understand the goals and objectives and all security requirements found in the RFP, as well as in this attachment.
To ensure that IGB can effectively oversee and regulate Video Gaming activities within the state, the Vendor's solution must be equipped with advanced security measures. The following requirements are specific to the communication central systems hosted in a Vendor cloud environment and are crucial for the IGB to monitor compliance and overall management of Video Gaming operations.
The Offeror must respond to the security requirements, where specified in the Attachment H – Response Template
A. Standard Security Requirements To safeguard the integrity of the Video Gaming activities and protect the data handled by the Central Communication System (CCS), stringent security measures are imperative. The CCS must incorporate a comprehensive suite of security protocols and technologies designed to defend against a wide range of cyberthreats, ensure the privacy of sensitive information, and maintain the reliability of video gaming operations. These standard security requirements form the cornerstone of a robust defense strategy, ensuring compliance with regulatory mandates and best practices in cybersecurity.
A.1. Vendor must comply with all the United States Federal and State of Illinois laws, rules, and regulations.
A.2. Vendor must comply with all of the State of Illinois Enterprise Security Policies ().
A.3. Vendor will notify the State of Illinois’ Chief Information Security Officer within 24 hours of knowledge of any information breach or any other security incident which impacts State of Illinois data. Send email notification to: DoIT.Security@illinois.gov and subject line should state “**Urgent Alert** Breach Notification.”
A.4. Vendor should have a documented security incident policy and plan. Vendor must supply a copy of the policy to the State of Illinois, when requested.
A.5. Vendor must ensure that all information technology, including electronic information, software, systems and equipment, developed or provided under this contract complies with the applicable requirements of the Illinois Information Technology Accessibility Act (IITAA) Standards and the Illinois Compiled Statutes for the Information Technology Accessibility Act 30 ILCS 587. If available, Vendor must provide the State of Illinois their most recent Voluntary Product Accessibility Template (VPAT).
A.6. Vendor program and project management personnel must ensure coordination of activities with the State of Illinois governance program. Vendor must comply with all policies, standards, and procedures defined by the State of Illinois Department of Innovation and Technology’s Enterprise Portfolio Management Office.
A.7. Vendor’s system must interface with the State of Illinois’ identity and access management solutions if authentication is required for access to the system.
A.8. Vendor’s system must log activity within the system and have capacity to forward log information to the State of Illinois’ security incident and event management system (SIEM). Vendor must meet the State of Illinois’ Minimum Logging Requirements for the term of the Contract.
A.8.1. See Section B (Minimum Logging Requirements) A.9. Vendor certifies it has undertaken independent third-party audit Statement on Standards for Attestation Engagements (SSAE-18) certifications and must provide the State of Illinois with a System Operation Controls report (SOC 1) annually and applicable bridge/gap letter when vendor is hosting State of Illinois financial information.
A.10. Vendor certifies it can comply with at least one of the following requirements listed in order of preference.
A.10.1. Vendor certifies it has undertaken independent third-party audit Statement on Standards for Attestation Engagements (SSAE-18) certifications and must provide the State of Illinois with a System Operation Controls report (SOC 2 type 2) annually and applicable bridge/gap letter.
A.10.2. Vendor must provide the State of Illinois with a 3rd party risk assessment of the Vendor’s system conducted within the last year including a 3rd party penetration test.
A.10.3. Vendor must perform an internal security controls assessment to demonstrate compliance with the State of Illinois Vendor Security Controls, based on the current revision of NIST 800-53 security controls for a moderate system. See Section C (Security Controls for Vendors) A.11. Vendor must participate in an annual risk assessment and data classification and system categorization process. The formal risk assessment will be administered by the State of Illinois.
If Vendor cannot provide the SOC 1 and/or 2 report required above and any necessary bridge/gap letter or another appropriate third-party risk assessment as determined by the State of Illinois, then Vendor must perform an internal security controls assessment to demonstrate compliance with the State of Illinois Vendor Security Controls, based on the current revision of NIST 800-53 security controls for a moderate system. Vendor must provide attestation of compliance along with the results of this assessment documented in a Security Assessment Report (SAR) to the State of Illinois. This does not relieve the Vendor of the above requirement to submit a required SOC 1 and/or SOC 2.
A.11.1. See Section C (Security Controls for Vendors) A.12. Vendor must provide a Plan of Action and Milestones (POA&M) to the State of Illinois that addresses any control deficiencies identified during the State of Illinois’ risk assessment, review of Vendor’s SOC report(s), third-party assessment, and internal security controls assessment. The POA&M should describe the deficiencies in the security controls, address the residual risk, and detail plans for remediation. Vendor must provide the State of Illinois monthly updates regarding progress toward remediation of identified deficiencies.
A.12.1. See Section D (Plan of Actions and Milestones Template) A.13. Vendor must complete and provide the State of Illinois an Authority to Operate (ATO) or Authority to Connect (ATC) packet at the State of Illinois’ request. This packet must be renewed annually.
A.13.1. See Section E (Authority to Operate/Authority to Connect Packet) A.14. Vendor must ensure all hosted data pertinent to this contract shall remain located within the contiguous United States.
A.15. Vendor must ensure encryption of State of Illinois data at rest and in motion. This encryption must comply with encryption security controls as defined in the most current version of the Federal Information Processing Standard (FIPS) 140 using Advanced Encryption Standard (AES) encryption with a minimum key length of 256 bits. Vendor must provide proof of encryption. Vendor must provide the State of Illinois with the capabilities to manage encryption keys for data at rest.
A.16. Vendor must store data in a non-proprietary, readily accessible format, or Vendor must provide a solution, at no additional cost to the State of Illinois, to extract any State of Illinois data stored in Vendor’s solution.
A.17. Vendor must only use State of Illinois data, for the purposes stated in this contract.
A.18. Vendor must maintain a robust and reliable data backup system. Vendor must supply a description of backup methodology, and this methodology must meet defined Maximum Tolerable Downtime (MTD) and Return to Operations (RPO) requirements.
A.19. At the State’s request, Vendor must provide a written disaster recovery methodology and provide proof of annual disaster recovery testing, including issues discovered and remediation plans for the issues discovered.
A.20. Vendor may not use any State of Illinois data in any non-production system or in any other system outside the application/service procured under this contract.
A.21. Vendor must provide a copy of all State of Illinois data (in a non-proprietary format) to the State of Illinois without delay upon request by the State of Illinois.
A.22. Vendor must provide a copy of all State of Illinois data (in a non-proprietary format) to the State of Illinois prior to termination of contract.
A.23. Vendor must sanitize all media that contains or contained State of Illinois data. Vendor must use the more current revision of NIST Special Publication 800-88, Guidelines for Media Sanitization. Vendor must provide the State of Illinois with a written certification of media sanitization including the method, date and time.
A.24. Vendor must use a form of “crypto shredding” acceptable to the State of Illinois for rendering all State of Illinois data hosted by the Vendor inaccessible after a copy of all data has been provided to the State of Illinois.
A.25. Vendor and/or its agents must not resell nor otherwise redistribute information gained from its access to the State of Illinois data.
A.26. Vendor must not engage in, nor permit its agents to push adware, software, or marketing that is not explicitly authorized by the State of Illinois.
A.27. Vendor must allow the State of Illinois to perform vulnerability assessments.
A.27.1. See Section F (Vulnerability Assessment) A.28. Vendor must immediately remediate critical, high, and medium vulnerabilities within the application that are detected during the security assessments and are determined by the State of Illinois to pose an unacceptable risk.
A.29. Vendor must secure independent third-party penetration testing at regular intervals, in accordance with Cloud Security Alliance (CSA) and Open Web Application Security Project (OWASP) recommendations. Vendor must supply the results of the testing to the State of Illinois upon request.
A.30. Vendor must supply a list of all non-proprietary/open-source software used in their solution. Vendor must also include the version and Open-Source Initiative (OSI) approved license type used for any open-source software. If Open Source uses non-OSI approved licensing Vendor must include licensing terms and conditions.
B. Minimum Logging Requirements To ensure accountability and transparency within the Video Gaming activities overseen by the Central Communication System (CCS), establishing minimum logging requirements is essential. The CCS must implement a detailed and systematic logging framework that captures all critical interactions, transactions, and system events. These logs will serve as an invaluable resource for auditing, troubleshooting, compliance verification, and security monitoring purposes. By maintaining comprehensive records, the CCS will facilitate a proactive approach to identifying and addressing potential issues, enhancing the overall security posture, and ensuring operational integrity. Adherence to these logging requirements is crucial for fostering trust among stakeholders and complying with regulatory standards.
B.1. Input validation failures (e.g., protocol violations, unacceptable encodings, invalid parameter names and values) B.2. Output validation failures (e.g., database record set mismatch, invalid data encoding) B.3. Authentication successes and failures B.4. Authorization (access control) failures B.5. Session management failures (e.g., cookie session identification value modification) B.6. Application errors and system events (e.g., syntax and runtime errors, connectivity problems, performance issues, third-party service error messages, file system errors, file upload virus detection, configuration changes) B.7. Application and related systems startups and shutdowns, and logging initialization (starting, stopping, or pausing) B.8. Use of higher-risk functionality (e.g., network connections, addition or deletion of users, changes to privileges, assigning users to tokens, adding or deleting tokens, use of systems administrative privileges, access by application administrators, all actions by users with administrative privileges, access to payment cardholder data, use of data encrypting keys, key changes, creation and deletion of system-level objects, data import and export including screen-based reports, submission of user-generated content — especially file uploads) B.9. Legal and other opt-ins (e.g., permissions for mobile phone capabilities, terms of use, terms & conditions, personal data usage consent, permission to receive marketing communications)
C. Security Controls for Vendors To ensure the highest level of security and reliability in Video Gaming operations managed by the Central Communication System (CCS), it is critical to establish rigorous security controls for vendors. These controls are designed to set a benchmark for security practices and technologies that vendors must adhere to, in order to protect against vulnerabilities and ensure the integrity of the gaming ecosystem. The security controls for vendors encompass a range of requirements, from the development and maintenance of the CCS to the handling of sensitive information and the mitigation of cybersecurity risks. By implementing these controls, vendors will demonstrate their commitment to safeguarding the operations and data of the Illinois Gaming Board (IGB) and its stakeholders, ensuring that the systems and services provided are not only compliant with industry standards but also resilient against evolving cyberthreats. This proactive stance on security is fundamental in maintaining the trust and confidence of all parties involved in the Video Gaming sector.
Authoritative Document NIST 800-53 v4 — Security and Privacy Controls C.1 Access and Control (AC) Organizations must limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems) and to the types of transactions and functions that authorized users are permitted to exercise.
Table 1:AC Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Access Control Policy and Procedures |
| AC-1 |
| · Account Management |
| AC-2 |
| (1), (2), (3), (4) |
| · Access Enforcement |
| AC-3 |
| · Information Flow Enforcement |
| AC-4 |
| · Separation of Duties |
| AC-5 |
| · Least Privilege |
| AC-6 |
| (1), (2), (5), (9), (10) |
| · Unsuccessful Logon Attempts |
| AC-7 |
| · System Use Notification |
| AC-8 |
| · Session Termination |
| AC-12 |
| · Permitted Actions without Identification or Authentication |
| AC-14 |
| · Remote Access |
| AC-17 |
| (1), (2), (3), (4) |
| · Wireless Access |
| AC-18 |
| (1) |
| · Access Control for Mobile Devices |
| AC-19 |
| (5) |
| · Use of External Information Systems |
| AC-20 |
| (1), (2) |
| · Information Sharing |
| AC-21 |
| · Publicly Accessible Content |
| AC-22 |
Authority
| CFR |
| HIPAA 45 CFR — 160, 162, 164 |
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.2 Awareness and Training (AT) Organizations must (i) ensure that managers and users of organizational information systems are made aware of the security risks associated with their activities and of the applicable laws, executive orders, directives, policies, standards, instructions, regulations, or procedures related to the security of organizational information systems; and (ii) ensure that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.
Table 2: AT — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Security Awareness and Training Policy and Procedures |
| AT-1 |
| · Security Awareness Training |
| AT-2 |
| (2) |
| · Role-Based Security Training |
| AT-3 |
| · Security Training Records |
| AT-4 |
Authority
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.3 Audit and Accountability (AU) Organizations must: (i) create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity; and (ii) ensure that the actions of individual information system users can be uniquely traced to those users, so they can be held accountable for their actions.
Table 3: AU — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Audit and Accountability Policy and Procedure |
| AU-1 |
| · Content of Audit Records |
| AU-3 |
| (1) |
| · Audit Storage Capacity |
| AU-4 |
| · Response to Audit Processing Failures |
| AU-5 |
| · Audit Review, Analysis, and Reporting |
| AU-6 |
| (1), (3) |
| · Audit Reduction and Report Generation |
| AU-7 |
| (1) |
| · Protection of Audit Information |
| AU-9 |
| (4) |
| · Audit Record Retention |
| AU-11 |
Authority
| CFR |
| HIPAA 45 CFR — 160, 162, 164 |
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.4 Certification, Accreditation, and Security Assessments (CA) Organizations must: (i) periodically assess the security controls in organizational information systems to determine if the controls are effective in their application; (ii) develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organization information systems; (iii) authorize the operation of organizational information systems and any associated information system connections; and (iv) monitor information system security controls on an ongoing basis to ensure the continued effectiveness of the controls.
Table 4: CA — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Security Assessment and Authorization Policy and Procedures |
| CA-1 |
| · Security Assessments |
| CA-2 |
| (1) |
| · System Interconnections |
| CA-3 |
| (5) |
| · Plan of Action and Milestones |
| CA-5 |
| · Security Authorization |
| CA-6 |
| · Continuous Monitoring |
| CA-7 |
| (1) |
| · Internal System Connections |
| CA-9 |
Authority
| NIST |
| SP 800-53 Security and Privacy Controls |
| NIST |
| SP 800-53A Assessing Security Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.5 Configuration Management (CM) Vendors must: (i) establish and maintain baseline configurations and inventories of organizational information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles; and (ii) establish and enforce security configuration settings for information technology products employed in organizational information systems.
Table 5: CM — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Configuration Management Policy and Procedures |
| CM-1 |
| · Baseline Configuration |
| CM-2 |
| (1), (3), (7) |
| · Configuration Change Control |
| CM-3 |
| (2) |
| · Security Impact Analysis |
| CM-4 |
| · Access Restrictions for Change |
| CM-5 |
| · Configuration Settings |
| CM-6 |
| · Least Functionality |
| CM-7 |
| (1), (2), (4) |
| · Information System Component Inventory |
| CM-8 |
| (1), (3), (5) |
| · Configuration Management Plan |
| CM-9 |
| · Software Usage Restrictions |
| CM-10 |
| · User-Installed Software |
| CM-11 |
Authority
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.6 Contingency Planning (CP) Organizations must establish, maintain, and effectively implement plans for emergency response, backup operations, and post-disaster recovery for organizational information systems to ensure the availability of critical information resources and continuity of operations in emergency situations.
Table 6: CP — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Contingency Planning Policy and Procedures |
| CP-1 |
| · Contingency Plan |
| CP-2 |
| (1), (3), (8) |
| · Contingency Training |
| CP-3 |
| · Contingency Plan Testing |
| CP-4 |
| (1) |
| · Alternate Storage Site |
| CP-6 |
| (1), (3) |
| · Alternate Processing Site |
| CP-7 |
| (1), (2), (3) |
| · Telecommunications Services |
| CP-8 |
| (1), (2) |
| · Information System Backup |
| CP-9 |
| (1) |
| · Information System Recovery and Reconstitution |
| CP-10 |
| (2) |
Authority
| CFR |
| HIPAA 45 CFR — 160, 162, 164 |
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.7 Identification and Authentication (IA) Organizations must identify information system users, processes acting on behalf of users, or devices and authenticate (or verify) the identities of those users, processes, or devices as a prerequisite to allowing access to organizational information systems.
Table 7: IA — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Identification and Authentication Policy and Procedures |
| IA-1 |
| · Identification and Authentication (Organizational Users) |
| IA-2 |
| (1), (2), (3), (8), (11), (12) |
| · Device Identification and Authentication |
| IA-3 |
| · Identifier Management |
| IA-4 |
| · Authentication Management |
| IA-5 |
| (1), (2), (3), (11) |
| · Authenticator Feedback |
| IA-6 |
| · Cryptographic Module Authentication |
| IA-7 |
| · Identification and Authentication (Non-Organizational Users) |
| IA-8 |
| (1), (2), (3), (4) |
Authority
| CFR |
| HIPAA 45 CFR — 160, 162, 164 |
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.8 Incident Response (IR) Organizations must: (i) establish an operational incident handling capability for organizational information systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities; and (ii) track, document, and report incidents to appropriate organizational officials and/or authorities.
Table 8: IR — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Incident Response Policy and Procedures |
| IR-1 |
| · Incident Response Training |
| IR-2 |
| · Incident Response Testing |
| IR-3 |
| (2) |
| · Incident Handling |
| IR-4 |
| (1) |
| · Incident Monitoring |
| IR-5 |
| · Incident Reporting |
| IR-6 |
| (1) |
| · Incident Response Assistance |
| IR-7 |
| (1) |
| · Incident Response Plan |
| IR-8 |
Authority
| CFR |
| HIPAA 45 CFR — 160, 162, 164 |
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.9 Maintenance (MA) Organizations must: (i) perform periodic and timely maintenance on organizational information systems; and (ii) provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct information system maintenance.
Table 9: MA — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · System Maintenance Policy and Procedures |
| MA-1 |
| · Controlled Maintenance |
| MA-2 |
| · Maintenance Tools |
| MA-3 |
| (1), (2) |
| · Nonlocal Maintenance |
| MA-4 |
| (2) |
| · Maintenance Personnel |
| MA-5 |
| · Timely Maintenance |
| MA-6 |
Authority
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.10 Media Protection (MP) Organizations must: (i) protect information system media, both paper and digital; (ii) limit access to information-on-information system media to authorized users; and (iii) sanitize or destroy information system media before disposal or release for reuse.
Table 10: MP — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Media Protection Policy and Procedures |
| MP-1 |
| · Media Transport |
| MP-5 |
| (4) |
| · Media Sanitization |
| MP-6 |
Authority
| CFR |
| HIPAA 45 CFR — 160, 162, 164 |
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.11 Physical and Environmental Protection (PE) Organizations must: (i) limit physical access to information systems, equipment, and the respective operating environments to authorized individuals; (ii) protect the physical plant and support infrastructure for information systems; (iii) provide supporting utilities for information systems; (iv) protect information systems against environmental hazards; and (v) provide appropriate environmental controls in facilities containing information systems.
Table 11: PE — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Physical and Environmental Protection Policy and Procedures |
| PE-1 |
| · Physical Access Authorizations |
| PE-2 |
| · Physical Access Control |
| PE-3 |
| · Access Control for Transmission Medium |
| PE-4 |
| · Access Control for Output Devices |
| PE-5 |
| · Monitoring Physical Access |
| PE-6 |
| (1) |
| · Visitor Access Records |
| PE-8 |
| · Power Equipment and Cabling |
| PE-9 |
| · Emergency Shutoff |
| PE-10 |
| · Emergency Lighting |
| PE-12 |
| · Fire Protection |
| PE-13 |
| (3) |
| · Temperature and Humidity Controls |
| PE-14 |
| · Water Damage Protection |
| PE-15 |
| · Delivery and Removal |
| PE-16 |
| · Alternate Work Site |
| PE-17 |
Authority
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.12 Planning (PL) Organizations must develop, document, periodically update, and implement security plans for organizational information systems that describe the security controls in place or planned for the information systems and the rules of behavior for individuals accessing the information systems.
Table 12: PL — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Security Planning Policy and Procedures |
| PL-1 |
| · System Security Plan |
| PL-2 |
| (3) |
| · Rules of Behavior |
| PL-4 |
| (1) |
| · Information Security Architecture |
| PL-8 |
Authority
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.13 Personnel Security (PS) Organizations must: (i) ensure that individuals occupying positions of responsibility within organizations (including third-party service providers) are trustworthy and meet established security criteria for those positions; (ii) ensure that organizational information and information systems are protected during and after personnel actions, such as terminations and transfers; and (iii) employ formal sanctions for personnel failing to comply with organizational security policies and procedures.
Table 13: PS — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Personnel Security Policy and Procedures |
| PS-1 |
| · Position Risk Designation |
| PS-2 |
| · Personnel Screening |
| PS-3 |
| · Personnel Termination |
| PS-4 |
| · Personnel Transfer |
| PS-5 |
| · Third-Party Personnel Security |
| PS-7 |
| · Personnel Sanctions |
| PS-8 |
Authority
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.14 Risk Assessment (RA) Organizations must periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals resulting from the operation of organizational information systems and the associated processing, storage, or transmission of organizational information.
Table 14: RA — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · Risk Assessment Policy and Procedures |
| RA-1 |
| · Security Categorization |
| RA-2 |
| · Vulnerability Scanning |
| RA-5 |
| (1), (2), (5) |
Authority
| CFR |
| HIPAA 45 CFR — 160, 162, 164 |
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.15 System and Services Acquisition (SA) Organizations must: (i) allocate sufficient resources to adequately protect organizational information systems; (ii) employ system development life cycle processes that incorporate information security considerations; (iii) employ software usage and installation restrictions; and (iv) ensure that third-party providers employ adequate security measures to protect information, applications, and or services outsourced from the organizations.
Table 15: SA — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · System and Services Acquisition Policy and Procedures |
| SA-1 |
| · Allocation of Resources |
| SA-2 |
| · System Development Life Cycle |
| SA-3 |
| · Acquisition Process |
| SA-4 |
| (1), (2), (9), (10) |
| · Information System Documentation |
| SA-5 |
| · Security Engineering Principles |
| SA-8 |
| · External Information System Services |
| SA-9 |
| (2) |
| · Developer Configuration Management |
| SA-10 |
| · Developer Security Testing and Evaluation |
| SA-11 |
Authority
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.16 System and Communications Protection (SC) Organizations must: (i) monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries for the information systems; and (ii) employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational information systems.
Table 16: SC — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · System and Communication Protection Policy and Procedures |
| SC-1 |
| · Application Partitioning |
| SC-2 |
| · Information in Shared Resources |
| SC-4 |
| · Denial of Service Protection |
| SC-5 |
| · Boundary Protection |
| SC-7 |
| (3), (4), (5), (7) |
| · Transmission Confidentiality and Integrity |
| SC-8 |
| (1) |
| · Network Disconnect |
| SC-10 |
| · Cryptographic Key Establishment and Management |
| SC-12 |
| · Cryptographic Protection |
| SC-13 |
| · Collaborative Computing Devices |
| SC-15 |
| · Public Key Infrastructure Certificates |
| SC-17 |
| · Voice Over Internet Protocol |
| SC-19 |
| · Secure Name/Address Resolution Service (Authoritative Source) |
| SC-20 |
| · Secure Name/Address Resolution Service (Recursive or Caching Resolver) |
| SC-21 |
| · Architecture and Provisioning for Name/Address Resolution Service |
| SC-22 |
| · Session Authenticity |
| SC-23 |
| · Protection of Information at Rest |
| SC-28 |
| · Process Isolation |
| SC-39 |
Authority
| CFR |
| HIPAA 45 CFR — 160, 162, 164 |
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
C.17 System and Information Integrity (SI) Organizations must: (i) identify, report, and correct information and information systems flaws in a timely manner; (ii) provide protection from malicious code at appropriate locations within organizational information systems, and (iii) monitor information system security alerts and advisories and take appropriate actions in response.
Table 17: SI — NIST Security Controls and Control Enhancements (for Moderate Security Categorization)
| Security Control Summary |
| Control # |
| Enhancement #’s |
| · System and Information Integrity Policy and Procedures |
| SI-1 |
| · Flaw Remediation |
| SI-2 |
| (2) |
| · Malicious Code Protection |
| SI-3 |
| (1), (2) |
| · Information System Monitoring |
| SI-4 |
| (2), (4), (5) |
| · Security Alerts, Advisories and Directives |
| SI-5 |
| · Software, Firmware, and Information Integrity |
| SI-7 |
| (1), (7) |
| · Spam Protection |
| SI-8 |
| (1), (2) |
| · Information Input Validation |
| SI-10 |
| · Information Handling and Retention |
| SI-12 |
| · Memory Protection |
| SI-16 |
Authority
| CFR |
| HIPAA 45 CFR — 160, 162, 164 |
| NIST |
| SP 800-53 Security and Privacy Controls |
| FIPS |
| 200 Minimum Security Controls |
| IRS |
| 1075 Tax Information Security Guidelines |
| DoIT |
| DoIT Policies and Associated Standards and Guidelines |
D. Plan of Actions and Milestones Template To effectively manage and mitigate risks within the Video Gaming operations facilitated by the Central Communication System (CCS), a structured Plan of Actions and Milestones (POAM) template is indispensable. This template serves as a strategic tool for vendors and the Illinois Gaming Board (IGB) to document, prioritize, and track the resolution of security vulnerabilities and other operational issues identified during assessments, audits, and ongoing monitoring.
| Identified Deficiency |
| Residual Risk |
| Detailed Remediation |
Plan with Timeline Expected Completion Date
E. Authority to Operate/Authority to Connect Packet For a secure and efficient operation within the Video Gaming ecosystem managed by the Central Communication System (CCS), obtaining an Authority to Operate (ATO) or Authority to Connect (ATC) is a critical step for vendors and their systems. This outlines the comprehensive evaluation process and the stringent criteria that must be met for a vendor's system to be granted permission to operate or connect within the state's video gaming network. It serves as a vital framework to ensure that all systems and components introduced to the network adhere to the highest standards of security, compliance, and operational integrity set forth by the Illinois Gaming Board (IGB).
F. Vulnerability Assessment In the pursuit of maintaining the highest standards of security within the Video Gaming ecosystem managed by the Central Communication System (CCS), conducting regular Vulnerability Assessments is paramount. These assessments are critical for identifying, quantifying, and prioritizing the vulnerabilities within a system. For vendors and the Illinois Gaming Board (IGB), understanding the potential weaknesses in the infrastructure, software, and processes is essential to preemptively address risks before they can be exploited.
F.1 Vendor must obtain approval on behalf of the State of Illinois to perform vulnerability assessments on the cloud-hosting vendor’s website(s).
F.2 Vendor must execute the State of Illinois Vulnerability Scanning Agreement prior to the vulnerability assessment. (See DoIT Scanning Agreement) F.2.1 State of Illinois may, with reasonable notice to Vendor, conduct a security assessment of Vendor’s solution, which may include the following:
F.2.1.1 Prior to initial “official” production role out of the application, F.2.1.2 Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application F.2.1.3 Manual verification of scan results with the same credentials F.2.1.4 Manual testing of the application for vulnerabilities F.2.1.5 State of Illinois will not conduct any Denial of Service (DOS) attacks F.2.1.6 State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)
F.2.2 On a quarterly basis for the for the first year after initial production deployment:
F.2.2.1 Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application F.2.2.2 Manual verification of scan results with the same credentials F.2.2.3 Manual testing of the application for vulnerabilities F.2.2.4 State of Illinois will not conduct any DOS attacks F.2.2.5 State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)
F.2.3 Prior to any enhancements or upgrades being deployed to production after the initial “official” production role out of the application:
F.2.3.1 Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application F.2.3.2 Manual verification of scan results with the same credentials F.2.3.3 Manual testing of the application for vulnerabilities F.2.3.4 State of Illinois will not conduct any DOS attacks F.2.3.5 State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)
F.2.4 Monthly vulnerability scan — no whitelisting, non-credentialed scan (same day every month)
END OF ATTACHMENT A – STATE STANDARD SECURITY REQUIREMENTS