Attachment_B_MSDE_Supplemental_Information_Technology_Requirements_10.23.24.pdf

ATTACHMENT B

MSDE SUPPLEMENTAL INFORMATION TECHNOLOGY REQUIREMENTS

1. Accessibility Requirements

These MSDE Supplemental Requirements are in addition to the requirements otherwise set forth in the solicitation. In the event of any conflict or inconsistency in any language in the solicitation or the Contract, the stricter language shall apply.

1.1 Accessibility Compliance.

A. The State is committed to ensuring that digital technology and services are accessible to individuals with disabilities in compliance with all applicable federal and State laws, regulations, and applicable technical standards. The Contractor shall be responsible for ensuring that any and all products and/or services provided under this Contract shall meet all accessibility requirements and standards set forth in applicable federal and State laws and regulations, including, without limitation, Education Article § 7-910 of the Annotated Code of Maryland, COMAR 13a.06.05, Title II of the Americans with Disabilities Act, the Federal Rehabilitation Act of 1973, 28 C.F.R. 35 (including the Final Rule on “Accessibility of Web Content and Mobile Apps Provided by State and Local Governments” the (“Final Rule”)), and the technical standard set forth in the Web Content Accessibility Guidelines (“WCAG”) 2.1, Level AA. The Contractor acknowledges that MSDE seeks to comply, and expects compliance from the Contractor, with the Federal Rule immediately. If any laws, regulations, or standards regarding accessibility of the provided products or services change during Contract performance, the Contractor shall agree to modify its products or services to comply with the changed laws, regulations, or standards.

B. The Contractor guarantees that all documents, materials, and other deliverables produced or provided as part of this Contract will be fully and equally accessible to persons with disabilities under all applicable federal and State laws and regulations, including those referenced in subsection A of this Section. If the documents, materials, and other deliverables are to be distributed or posted to MSDE’s website, final versions shall be ready for posting with no additional modification to the documents, materials, or other deliverables necessary to be performed by MSDE. This includes documents and materials provided in English, as well as those documents and materials that the Contractor is required to translate into another language.

C. The Contractor guarantees that all digital tools and/or any web content and mobile app services supplied under this Contract meet the accessibility standards set forth in WCAG 2.1 Level AA. Further, the Contractor guarantees all digital tools and/or any web content and mobile app services supplied under this Contract conform to meet any requirements under all applicable Federal and State laws and regulations, including those referenced in subsection A of this Section.

D. The Contractor agrees to adhere to all requirements of Education Article § 7-910 and any applicable regulations. The Contractor also agrees to adhere to all requirements set forth in 28 C.F.R. 35, including Final Rule, as it relates to the services provided to the State by the Contractor.

E. The Contractor may not provide non-accessible or alternative non-conforming digital tools or any web content and mobile app services unless exceptions are specifically authorized in writing to do so by the State. Any conforming alternative version of any digital or any web content and mobile app services, or any portion thereof, must be approved in writing by the State.

F. If there is any conflict or inconsistency in the solicitation or the resulting Contract regarding accessibility standards that must be met by the Contractor, the higher standard shall prevail. Any attempt by the Offeror/Bidder or Contractor to limit its compliance with accessibility laws, regulations, or solicitation requirements in its proposal/bid shall not be allowed and such language shall be considered void in the event the parties enter into a Contract.

G. If there is a technical proposal submitted in response to a request for proposals (“RFP”), the Offeror shall describe how its products and/or services are accessible under applicable laws, regulations, and the WCAG 2.1, Level AA technical standard.

H. If there is a bid submitted in response to an invitation for bids (“IFB”), the Bidder hereby warrants that its products and/or services are accessible under applicable laws, regulations, and the WCAG 2.1, Level AA technical standard.

I. If this Contract is the result of a sole source procurement or intergovernmental cooperative purchasing agreement (including a participating addendum), the Contractor hereby warrants that its products and/or services are accessible under applicable laws, regulations, and the WCGA 2.1, Level AA technical standard.

J. In its technical proposal, the Offeror shall clearly inform the State if it believes that accessibility compliance will result in an undue financial or administrative burden to the State without including any pricing information. However, any final determination of any undue financial or administrative burden shall rest solely with the State and, unless directed otherwise, the Offeror must still adhere to all applicable accessibility laws and technical requirements. The Offeror shall structure its technical and financial proposals based upon adherence to all applicable accessibility laws and technical requirements.

1.1.1 Accessibility Maintenance and Support.

During the Contract term, the Contractor shall provide ongoing maintenance and support for accessibility for provided products and services, including, but not limited to, any digital tools and any web content and mobile app services. The ongoing maintenance and support shall consist of, at a minimum, the services described in this section.

A. Accessibility Compliance Audits. The Contractor shall periodically, but no less than annually, conduct accessibility compliance audits, to ensure continued compliance with all applicable laws, regulations, and the WCAG 2.1 Level AA technical standard. This audit shall a Voluntary Product Accessibility Template (VPAT) and the VPAT must adhere to the current published standards (currently - version 2.5 REV WCAG or 2.5 REV 508 or their latest rendition). The audit must include a list of identified WCAG 2.1 Level AA areas of non-compliance and estimated remediation timeframes. The results of the audit shall be provided to the Contract Monitor no later than 120 days after the Contract start date and annually thereafter.

The State reserves the right to request additional accessibility compliance audits, at no additional cost to the State if the State, in its sole discretion, determines there is a need for an audit more than annually.

B. State-Conducted Accessibility Compliance Audits. The State reserves the right to conduct its own accessibility compliance audit in order to determine if the Contractor is in compliance with all applicable laws, regulations, and the WCAG 2.1 Level AA technical standard. MSDE’s failure to conduct an accessibility compliance audit does not waive the duties and obligations of the Contractor to comply with all applicable laws, regulations, and technical standards related to accessibility.

C. Accessibility Remediation. The Contractor shall remediate any identified non-compliance with any applicable laws, regulations, and the WCAG 2.1, Level AA technical standard, conduct validation testing, and provide documentation of the testing results within thirty (30) days of notification of its discovery of any non-compliance or notice of any non-compliance, whichever is earlier. The remediation shall be at no additional cost to the State. The Contract Monitor may allow an additional time for remediation, if the Contractor appears to be working diligently toward remediation but cannot meet the thirty (30) day deadline.

1.1.2 Accessibility Compliance Indemnity and Potential Penalties.

A. For purposes of clarification, the Contractor’s indemnification obligations set forth in Exhibit 2 – Contract shall include the accessibility compliance requirements set forth in this Section and any claims, demands, actions, suits, damages, liabilities, losses, settlements, judgments, costs and expenses (including but not limited to attorneys’ fees and costs), whether or not involving a third party claim, which arise out of or relate to the Contractor’s, or any of its subcontractors’, compliance with applicable laws, regulations, and guidelines associated with accessibility compliance. Nothing in this Section shall be viewed as limiting the indemnification requirements and obligations set forth in Exhibit 2 – Contract.

B. Any limitation of liability clause in the Contract shall not apply to accessibility compliance and the Contractor’s liability shall be unlimited.

C. In addition to the indemnification obligations set forth in this Section and in this Contract, if the Contractor fails to meet the equivalent access standards required by any applicable federal or State law or regulation, it may be assessed civil penalties or fine, including those set forth in Education Article § 7-910.

1.1.3 Third-Party Technology.

The Contractor acknowledges and agrees that supplying third-party technology, products, or services does not exempt the Contractor from ensuring that the products or services provided under this Contract comply with the accessibility requirements of this Section. The Contractor bears sole responsibility for determining the accessibility of such technology, products, or services and must ensure that any product can be edited or remediated as necessary to comply with accessibility standards.

1.1.4 Information Technology Supplemental

The Information Technology Supplemental section entitled “Nonvisual Access” shall be construed in its entirety to require the Contractor to meet all accessibility requirements set forth in Federal and State laws and regulations, regardless of whether a disability and the corresponding accessibility requirement is related to vision. All subsections of “Nonvisual Access” shall be interpreted broadly and liberally to extend beyond vision in order to comply with all applicable accessibility and equivalent access standards.

2. Security and Privacy procurement language:

3.7.4 Information Technology

A. Contractors shall comply with and adhere to policies of the State Information

Technology (IT) Security Policy and Standards. These policies may be revised from time to time and the Contractor shall comply with all such revisions. Updated and revised versions of the policies are available online at: www.doit.maryland.gov – keyword:

Security Policy.

B. The Contractor shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor-owned equipment to a State LAN/WAN.

The Contractor shall:

1. Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security, such as, but not limited to, those listed below (See RFP Section 3.7.5 Information

System Security);

2. Ensure that all such safeguards, including the way State data is collected, accessed, used, stored, processed, disposed of, and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract (See

RFP Section 3.7.6 Data Security and Privacy Protection and Controls, and 3.7.7

Security Logs and Reports Access); and

3. The Contractor, and Contractor Personnel, shall (i) abide by all applicable Federal, State, and local laws, rules, and regulations concerning security of Information

Systems and Information Technology http://www.doit.maryland.gov/

3.7.5 Information System Security

1. Production-hosted Contract Requirements.

a. For service organizations that host production systems/applications within their own environment, MSDE requires the organization to meet, at a minimum, the following requirements:

i. Cloud Environment – The offering must be Federal Risk and

Authorization Management Program (FEDRAMP) authorized at a

Moderate level (IaaS, PaaS, SaaS)

ii. Non-cloud Environment – The offering must be System and

Organization Controls (SOC) 2 Type 2 compliant.

iii. Certification and accreditation-Authorization to operate must be demonstrated annually and provided to the MSDE representative.

b. Service organizations that do not meet the cloud or non-cloud environment requirement must seek third-party assessment to perform a security evaluation of the hosted environment. The evaluation must be based on the implementation of security controls consistent with the National Institute of Standards and

Technology (NIST) Special Publication (SP) 800-53 Rev. 5, Security and Privacy

Controls for Information Systems and Organizations. The service organization should provide security assessment reports for the security evaluation performed by the third-party assessor.

2. State-hosted Contract Requirements.

a. The State may elect to perform a security evaluation of systems/applications developed by MSDE vendors. The evaluation will be based on the implementation of security controls consistent with National Institute of

Standards and Technology (NIST) Special Publication (SP) 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. The vendor must support MSDE’s assessment of the system/application to obtain production deployment authorization.

3.7.6 Data Security and Privacy Protection and Controls

To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls at all times throughout the Term of the Contract (the Contractor may augment this list with additional controls):

A. Data Storage and Encryption:

1. Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not replicated in test or training environment(s) unless it has been previously anonymized or otherwise modified to protect the confidentiality of

Sensitive Data elements. The Contractor shall ensure the appropriate separation of production and non-production environments by applying the data protection and control requirements listed in Section 4.34.5

2. Apply hardware and software hardening procedures as recommended by Center for Internet Security (CIS) guides https://www.cisecurity.org/, Security Technical

Implementation Guides (STIG) https://public.cyber.mil/stigs/, or similar industry best practices to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control. These procedures may include but are not limited to removal of unnecessary software, disabling, or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the

Contractor’s system configuration files.

3. Ensure that State data is not commingled with non-State data through the proper application of compartmentalization Security Measures.

4. For all State data the Contractor manages or controls, data encryption mechanism must be applied to protect the confidentiality and integrity of such data both at rest and in transit over untrusted networks.

https://public.cyber.mil/stigs/

5. Encryption algorithms which are utilized for encrypting data shall comply with current Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-2:

a) http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf

b) http://csrc.nist.gov/groups/STM/cmvp/documents/140-

1/1401vend.htm

B. Access Controls:

1. Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers and information security standards, including Maryland DoIT

Information Security Policy.

2. Enabling access to the shared data should be strictly controlled and limited to authorized personnel who have a legitimate need to access the data.

3. User access rights should be granted based on the principle of least privilege, ensuring that individuals are only granted access to the specific data necessary to perform their job functions.

4. Strong authentication mechanisms, such as multifactor authentication, should be employed to verify the identity of users accessing the shared data.

5. Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and remediation, if required. MSDE shall have the right to inspect these policies and procedures and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under the Contract.

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

C: Prevention of Unauthorized Access, Use, and Disclosure

1. Implement robust network security measures, including firewalls, intrusion detection systems, and intrusion prevention systems to protect against unauthorized access attempts and intrusions.

2. Review, at least annually, the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

3. Perform regular vulnerability assessments and penetration testing to identify and remediate any security vulnerabilities or weaknesses of operating system, application, and network devices. The vulnerability assessment and penetration testing help identify outdated software versions; missing software patches; device or software misconfigurations; and validate compliance with or deviations from the security policies applicable to the Contract.

4. Evaluate all identified vulnerabilities for potential adverse effect on security and integrity and remediate the vulnerability no later than thirty (30) days following the earlier of vulnerability’s identification or public disclosure, or document explaining why remediation action is unnecessary or unsuitable. MSDE shall have the right to inspect the Contractor’s policies and procedures and the results of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

5. Policies and procedures must be in place to ensure that data is not used or disclosed inappropriately without proper authorizations.

6. Enforce strong user authentication and password control measures to minimize the opportunity for unauthorized access through compromise of the user access controls. At a minimum, the implemented measures should be consistent with the most current Maryland DoIT Information Security Policy

(https://doit.maryland.gov/policies/Pages/default.aspx), including specific requirements for password length, complexity, history, and account lockout.

https://doit.maryland.gov/policies/Pages/default.aspx

7. Ensure State data is not processed, transferred, or stored outside of the United

States (“U.S.”). The Contractor shall provide its services to the State and the

State’s end users solely from data centers in the U.S. Unless granted an exception in writing by the State, the Contractor shall not allow Contractor Personnel to store State data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Contractor shall permit its Contractor Personnel to access State data remotely only as required to provide technical support.

8. Ensure Contractor’s Personnel shall not connect any of its own equipment to a

State LAN/WAN without prior written approval by the State, which may be revoked at any time for any reason. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor -owned equipment to a State

LAN/WAN.

9. Ensure that anti-virus and anti-malware software is installed and maintained on all systems supporting the services provided under the Contract; that the anti-virus and anti-malware software is automatically updated; and that the software is configured to actively scan and detect threats to the system for remediation. The

Contractor shall perform routine vulnerability scans and take corrective actions for any findings.

10. Conduct regular external vulnerability testing designed to examine the service provider’s security profile from the Internet without benefit of access to internal systems and networks behind the external security perimeter. Evaluate all identified vulnerabilities on Internet-facing devices for potential adverse effects on the service’s security and integrity and remediate the vulnerability promptly or document if the remediation action is unnecessary or unsuitable. MSDE shall have the right to inspect these policies and procedures and the performance of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract

C: Data Minimization

1. Collect and retain the minimum amount of data necessary to fulfill the purposes outlined in the data sharing agreement.

2. Unnecessary or excessive data must be promptly and securely disposed of, in accordance with applicable data retention and destruction policies. See RFP section 3.2.5 Maintenance, Return and Data Destruction.

Consent and Lawful Use

1. Ensure to obtain necessary consents and authorizations to collect, use, and share the data in compliance with applicable laws and regulations.

2. The data shall only be used for the purposes specified, and any additional use or disclosure requires prior written consent from MSDE.

Privacy Impact Assessments

1. Conduct privacy impact assessments (PIAs) to evaluate and address any potential privacy risks associated with the collection, use, and sharing of the data.

2. PIAs should be conducted in accordance with the relevant privacy laws, regulations, and guidelines.

3.7.7 Security Logs and Reports Access

1. For a SaaS or non-State hosted solution, the Contractor shall provide reports to the

State in a mutually agreeable format.

2. Reports shall include latency statistics, user access, user access IP address, user access history and security logs for all State files related to the Contract.

3.7.8 Security Plan

1. The Contractor shall protect State data according to a written security policy

(“Security Plan”) no less rigorous than that of the State and shall supply a copy of such policy to the State for validation, with any appropriate updates, on an annual basis.

2. The Security Plan shall detail the steps and processes employed by the Contractor as well as the features and characteristics which will ensure compliance with the security requirements of the Contract.

3.7.9 Security Incident Response and Data Breach

The Federal Information Security Modernization Act (FISMA) defines an incident as “an occurrence” that 1) actually, or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or 2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where 1) a person other than an authorized user accesses or potentially accesses personally identifiable information or 2) an authorized user accesses or potentially accesses personally identifiable information for another than authorized purpose. In the event of a suspected or confirmed incident or breach, the Contractor and or any subcontractor shall:

A. Report all suspected and confirmed information security incidents and data breaches immediately, and in consultation with the MSDE representative, using the Incident

Reporting Form to the Maryland Department of Information Technology (DoIT) and the Maryland state chief information security officer (CISO) at

SOC.DOIT@maryland.gov. The types of information required in an incident report must include at a minimum: company and point of contact information, agreement/contract information, impact classifications/threat vector, and the type of information compromised.

B. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract to avoid a secondary sensitive information incident with

FIPS 140-2 validated encryption.

C. NOT notify affected individuals unless instructed by MSDE’s designated representative. If so instructed, the Contractor and or any subcontractor shall send

MSDE approved notifications to affected individuals as directed by MSDE’s SOC.

https://www.marylandpublicschools.org/programs/Documents/Operations/OIT/Incident-Reporting-Form.docx https://www.marylandpublicschools.org/programs/Documents/Operations/OIT/Incident-Reporting-Form.docx mailto:SOC.DOIT@maryland.gov

D. Cooperate and exchange any information, as determined and as necessary to effectively manage or mitigate a suspected or confirmed incident or breach.

E. NOT include any sensitive information in the subject or body of any reporting e-mail and encrypt sensitive information in attachments to email, media, etc.

F. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally

Identifiable Information and MSDE incident response policies and handling PII breaches.

G. Provide full access and cooperate on all activities as determined by MSDE to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the information from the Internet or other networks or applying additional security controls. This may also involve physical access to the Contractor and or any subcontractor facilities during an incident/breach investigation demand.

H. The Contractor and or any subcontractor shall respond to all Alerts/Indicators of

Compromise (IOCs) provided by MSDE or DoIT, Security Operations Center (SOC), SOC.DOIT@maryland.gov within 24 hours, whether the response is positive or negative.

If a Data Breach is a direct result of the Contractor’s breach of its Contract obligation to encrypt

State data or otherwise prevent its release, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by State law; (3) a credit monitoring service required by State or federal law; (4) a website or a toll-free number and call center for affected individuals required by State law; and

(5) complete all corrective actions as reasonably determined by Contractor based on root cause;

all [(1) through (5)] subject to the Contract’s limitation of liability

3.7.10 Compliance with Laws and Regulations

The Contractor shall comply with all applicable laws and regulations related to the collection, use, and disclosure of the data shared with them under the data sharing agreement. Specifically, the Contractor shall adhere to the following statutory requirements:

A. Maryland Protection of Information by Government Agencies (MD PIGA): The

Contractor shall ensure the protection of individuals’ privacy in compliance with the

2021 Maryland Statutes State Government Title 10-Governmental Procedures, Subtitle 13-Protection of Information by Government Agencies, Section 10-1301-

Definitions, MD. State Government Code Ann. § 10-1301 (MD PIGA).

B. Health Insurance Portability and Accountability Act (HIPAA): The Contractor shall protect the privacy and security of health data created, received, stored, or transmitted by Covered Entities and their Business Associated in relation to the provision of healthcare, healthcare operations, and payment for healthcare services. This includes compliance with all pertinent privacy regulations (45 C.F.R. Parts 160 and 164) and security regulations (45 C.F.R. Parts 160, 162, and 164, as amended from time to time, issued by the U.S. Department of Health and Human Services, including any amendments introduced by the Health Information Technology for Economic and

Clinical Health Act (HITECH Act).

C. Maryland Health Information Privacy Act (MHIPA): The Contractor shall comply with the requirements of the MHIPA when handling health information shared under the data sharing agreement. Specifically, the third party shall:

i. Notice of Privacy Practices: The third party shall provide individuals with a clear and comprehensive notice describing their privacy practices related to health information, including how the information may be used and disclosed, and individuals’ rights regarding their health information.

ii. Individual Rights: The third party shall respect individuals’ rights to access their health information, request amendments if necessary, and obtain an accounting of disclosures made by the third party.

iii. Consent and Authorization: The third party shall obtain appropriate consent or authorization from individuals for the use and disclosure of their health information, except where otherwise permitted or required by law.

iv. Security and Safeguards: The third party shall implement reasonable and appropriate security measures to safeguard health information from unauthorized access, use, or disclosure. This includes the adoption of administrative, physical, and technical safeguards to ensure the confidentiality and integrity of the information.

v. Breach Notification: In the event of a breach of unsecured health information, the third party shall comply with the breach notification requirements outlined in MHIPA. This may include notifying affected individuals, the Maryland Attorney General, and the Maryland

Insurance Administration, as specified in the law.

vi. Retention and Destruction: The third party shall adhere to MHIPA’s requirements regarding the retention and destruction of health information. This includes following appropriate retention schedules and securely disposing of health information in accordance with NIST

SP 800-88 guidelines.

vii. Compliance Monitoring: The third party shall establish mechanisms to monitor and assess ongoing compliance with MHIPA requirements. This may involve conducting regular audits, risk assessments, and staff training programs to ensure the proper handling and protection of health information.

D. Family Educational Rights and Privacy Act (FERPA): The third party shall ensure the privacy and confidentiality of student education records, whether in paper, computerized, or any other recorded format. Compliance with FERPA (20 U.S.C

§1232g) and its implementing regulations *34 C.F.R. Part 99) is required to protect the sensitive information contained in educational records.

E. Children’s Online Privacy Protection Act (COPPA): The third party shall prohibit unfair or deceptive acts or practices in connection with the collection, use, and disclosure of personal information from and about children on the internet. Compliance with COPPA safeguards the privacy and security of children’s personal information online.

F. Payment Card Industry Data Security Standard (PCI DSS): The third party shall ensure the security of credit card transactions and adhere to the Payment Card

Industry Data Security Standard. Validation of Compliance with PCI DSS shall be conducted annually to safeguard the confidentiality and integrity of credit card data.

G. Internal Revenue Service Publication 1075 (IRS 1075): The third party shall ensure the protection and confidentiality of Federal Tax Information (FTI) in compliance with IRS 1075. Specifically, the third party shall:

i. Protect the privacy and security of FTI obtained or accessed while providing services under the data sharing agreement.

ii. Adhere to the requirements and safeguards outlined in IRS 1075, which govern the handling, storage, processing, and disclosure of FTI.

iii. Implement appropriate administrative, technical, and physical controls to safeguard FTI from unauthorized access, use, disclosure, modification, or destruction.

iv. Ensure that only authorized personnel with a legitimate need-to-know have access to FTI and that access is strictly controlled and monitored.

v. Comply with the data handling and retention requirements specified in

IRS 1075 for the data sharing agreement's duration.

vi. Prohibit the unauthorized use of disclosure of FTI to any unauthorized individuals or entities.

H. Criminal Justice information Services (CJIS): The third party must preserve data integrity by implementing best practices for wireless networking, remote access, data encryption, and multi-factor authentication in accordance with the requirements of the

CJIS division of the Federal Bureau of Investigation (FBI). Compliance with CJIS safeguards the security of criminal justice information.

Security, Privacy, and Accessibility Grant Assurances

• Prior to the transfer of any state data, the grantee and MSDE must have a Data Use

Agreement and Privacy Threshold Analysis, current and on file. This agreement must cover security and privacy controls required on the system as described in the IT supplemental on the Maryland state procurement website.

• Access to the data is restricted to authorized users only. Unauthorized access, use, misuse, or modification of this computer system or of the data contained herein or in transit to/from this system constitutes a violation state of Maryland information technology security manual version 1.2 127 of article 27 §§ 45a and 146 of the annotated codes of Maryland, Title 18, USC, § 1030, and may subject the individual to criminal and civil penalties pursuant to Title 26, USC, §§ 7213(a), 7213a, and 7431.

• The system storing or processing state data and equipment are subject to monitoring to ensure proper performance of applicable security features or procedures.

Such monitoring may result in the acquisition, recording and analysis of all data being communicated, transmitted, processed or stored in this system by a user.

If monitoring reveals possible evidence of criminal activity, such evidence may be provided to law enforcement personnel. Anyone using this system expressly consents to such monitoring.

• All digital tools and/or services provided for this grant must meet all accessibility requirements and standards set forth in applicable federal and State laws and regulations, including, without limitation, Education Article § 7-910 of the Annotated Code of

Maryland, COMAR 13a.06.05, Title II of the Americans with Disabilities Act, the

Federal Rehabilitation Act of 1973, 28 C.F.R. 35 (including the Final Rule on

“Accessibility of Web Content and Mobile Apps Provided by State and Local

Governments” the (Final Rule)), and the technical standard set forth in the Web Content

Accessibility Guidelines (WCAG) 2.1, Level AA.

• All public facing systems must meet the minimum accessibility requirements.

• All vendors shall provide an Accessibility Conformance Report (ACR) using the

Voluntary Product Accessibility Template (VPAT) reporting conformance to Revised

Section 508 standards and Web Content Accessibility Guidelines (WCAG). The completed VPAT must adhere to the current published standards (currently - version 2.5 or their latest rendition).

o Any digital tool that does not meet the minimum accessibility requirements as shown on the ACR, must be accompanied by an accessibility roadmap or plan of action with milestones (roadmap /plan) to be considered. A roadmap /plan will help set goals and priorities and provide a framework for accessibility improvement for the digital tool over time as the vendor works toward compliance.

3. Project Management Requirements

A. The State has an established Project Management Office (PMO) that will be overseeing each project for the Department. The PMO uses standardized tools (e.g.

Jira by Atlassian, Smartsheet, Microsoft Office, etc.) and procedures to manage each project. The use of such tools is required to be used by the State’s project team. The

Contractor shall be responsible for ensuring that all products and/or services provided under this Contract shall be used with respect to the tools and procedures required by the State. The Contractor must engage with the State’s project team on the determined channels for communication as given access and permissions.

B. The Contractor shall provide a listing of all tools that it uses for Project Management for the State to be aware of. The State uses Microsoft Office 365, Jira, and Smartsheet for Project Management purposes and reporting. These tools are approved for use due to the State’s standards for security compliance, accessibility, and privacy. The State will not engage in the use of proprietary tools or different task management applications unless deemed necessary, with proper written approval from the State’s

IT leadership.

a. Microsoft Teams is used as a Project specific hub. The State will invite the

Contractor’s designated staff to the Project-specific Microsoft Team, where posts will be shared to seek updates or notifications on open items or issues;

files will be shared in an organized folder structure; and meeting notes will be maintained by the State in a OneNote Notebook associated with the Microsoft

Team. The Contractor is expected to engage with the State using these means of communication and file

b. The State requires Contractors to use Jira by Atlassian for task management, or the management of tasks as tickets associated with the development or execution of the project scope and requirements. Licenses will need to be provided for project teams to use Jira, with funding determined at the time of contracting.

i. License costs for all users, including those from the State, shall be covered by the Contractor when administering the Jira instance.

ii. In the event of the State administering the instance of Jira, a list of intended users shall be presented along with their roles to confirm the need for a Jira license. The license costs associated with Contractor users shall be deducted from costs owed by the State to the Contractor.

C. A Communication Plan is required by the State to be provided by the Contractor in order to establish the appropriate channels, personnel, applications, and means for communication. The Communication Plan must include, but is not limited to:

a. Contact information for Project Sponsors

b. Contact information for Project Stakeholders

c. Contact information for Project Manager

d. Times of availability*

i. *The State shall be provided with a schedule of availability. Calendars can be shared between the Contractor and the State.

e. A listing of the tools being used, with links to those tools as they become available

f. Standard Operating Procedures for communicating and collaborating on different aspects of the project, such as…

i. Sprint Planning

ii. Status Updates

iii. Release Management

iv. Retrospectives

v. Vendor correspondence

vi. Risk Management

vii. Schedule Management

viii. Task Management

ix. Scope Management

x. Budget Management

xi. Disaster Recovery

xii. Responses to Critical Issues