Attachment_D_-_Information_Security_Requirements_&_Information_Requests_for_RFPs.pdf
PDF 216 KB Posted
- Attached to
- Emergency Communications Satellite Phones
- Solicitation number
- PR8471
- Issued by
- Florida
About this file
This document is Attachment D for Information Security Requirements and Information Requests for RFPs, dated 5/2/2019, from OUC (Orlando Utilities Commission). The document outlines comprehensive security requirements for vendors proposing hybrid or cloud solutions, mandating adherence to specific security principles and requiring detailed responses across eight critical information security domains: personnel security, asset management, solution development environment management, access control, audit logs, data protections, change management, and cyber security events.
The requirements are extensive, compelling vendors to provide in-depth information about their technological solution's security posture, including background checks for personnel, security framework compliance, access management capabilities, encryption methods, breach notification policies, and incident response plans. Vendors must demonstrate robust security practices such as multi-factor authentication, least privilege access principles, data confidentiality protections, and the ability to support security monitoring through compatible logging and SIEM (Security Information and Event Management) systems. Notably, vendors must consent to Internet Security Reputation Monitoring, with the understanding that a reputation score dropping below a medium level could result in contract modification.
View the file
Other files
Show all 16
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Attachment D
Information Security Requirements & Information Requests for RFPs 5/2/2019
If a hybrid or a cloud solution is proposed the vendor agrees to:
• Adhere to the TERMS & CONDITIONS PRINCIPLES FOR A CLOUD-HOSTED SOLUTION
• Complete the Security Questionnaire for Hosted Vendor Solutions
• Consent to Internet Security Reputation Monitoring services. If a vendor’s reputation score drops below a medium level, the agreement may be subject to change.
The vendor shall supply the following information for their solution and any third-party associated technology integrated into the solution:
1. Personnel Security
1.1. Before being granted access to OUC data, personnel shall complete an OUC background check.
1.2. Personnel developing, administering, and managing the solution technologies shall have information security-appropriate training. Provide details, including completion dates of this training for all applicable personnel.
2. Asset management
2.1. List the make, model, version of the technology solution components.
2.2. Define the integrations required and the association to the components listed above.
3. Secure solution development and production environment management
3.1. List any in-place security frameworks in the development and production environments, such as NIST, CSC CIS, or ISO.
3.2. List in-place security-related attestations in the development and production environments.
3.3. List all security testing and security controls used for development and on-going security support of your solution.
3.4. List any standard security products supported by your solution, such as anti-malware and application whitelisting.
3.5. Describe your vulnerability management process.
3.6. Describe your security vulnerability notification policy and process.
4. Access control
4.1. Describe the access management capabilities of the proposed solution.
4.2. List the roles that the solution supports.
4.3. List in-place privileged access roles.
4.4. Describe the access required to support the solution.
4.5. Describe how the access control functions support the principles of least privilege and separation of duties.
4.6. Describe how dormant accounts are identified.
4.7. Describe the multi-factor authentication function, if applicable.
4.8. Indicate if an automated data classification function is part of the solution.
4.9. List any integrated directories services such as LDAPs or cloud services such as Okta.
5. Audit logs
5.1. Provide the types of logs included in the solution.
5.2. Indicated if an events interpretation key is available to support identification and analysis of anomalous activity.
5.3. Indicate if these logs are readily consumable by SIEMs such as Splunk.
6. Data Protections and Recovery capabilities
6.1. Describe the protections that provide data confidentiality, integrity, and availability assurance.
6.2. Indicate if detection and alerting on potential data exfiltration is included in the solution.
6.3. Describe the encryption and ciphers included for data at rest and in motion.
6.4. Describe the data recovery ability and the typical recovery timeframe.
6.5. Supply a sample data set that might be required for your solution.
7. Change management
7.1. Describe your internal change management process.
7.2. Describe the communications and timeframe for communications OUC can expect to receive on change management.
7.3. Describe the recourse available to OUC if a planned change is not acceptable.
7.4. Describe the notification OUC can expect to receive if a change causes an issue.
8. Cyber security events
8.1. Provide your breach notification policy and process.
8.2. Indicate if your organization has an incident response plan. If so, provide the plan.
| If a hybrid or a cloud solution is proposed the vendor agrees to: |
| 1. Personnel Security |
| 2. Asset management |
| 3. Secure solution development and production environment management |
| 4. Access control |
| 5. Audit logs |
| 6. Data Protections and Recovery capabilities |
| 7. Change management |
| 8. Cyber security events |
File details come from the government source that posted it. Updated .