Attachment_D_-_Information_Security_Requirements_&_Information_Requests_for_RFPs.pdf
PDF 216 KB Posted
- Attached to
- Emergency Communications Satellite Phones
- Solicitation number
- PR8471
- Issued by
- Florida
About this file
This document is an Information Security Requirements & Information Requests for RFPs attachment dated 5/2/2019 from OUC (Orlando Utilities Commission) for vendors proposing hybrid or cloud solutions. The document outlines comprehensive security requirements and information requests that vendors must address across eight key areas: personnel security, asset management, secure solution development, access control, audit logs, data protections, change management, and cybersecurity events. Vendors are required to provide detailed information about their technological solutions, including security frameworks, access management capabilities, encryption methods, and incident response procedures.
The requirements are designed to ensure robust information security for potential vendor solutions, with specific expectations including background checks for personnel, adherence to security frameworks like NIST and ISO, multi-factor authentication, data confidentiality and integrity protections, and comprehensive breach notification processes. Vendors must consent to Internet Security Reputation Monitoring and understand that their agreement may be subject to change if their reputation score drops below a medium level. The document emphasizes principles of least privilege, separation of duties, and the need for transparent communication about system changes and potential security vulnerabilities.
View the file
Other files
Show all 16
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Attachment D
Information Security Requirements & Information Requests for RFPs 5/2/2019
If a hybrid or a cloud solution is proposed the vendor agrees to:
• Adhere to the TERMS & CONDITIONS PRINCIPLES FOR A CLOUD-HOSTED SOLUTION
• Complete the Security Questionnaire for Hosted Vendor Solutions
• Consent to Internet Security Reputation Monitoring services. If a vendor’s reputation score drops below a medium level, the agreement may be subject to change.
The vendor shall supply the following information for their solution and any third-party associated technology integrated into the solution:
1. Personnel Security
1.1. Before being granted access to OUC data, personnel shall complete an OUC background check.
1.2. Personnel developing, administering, and managing the solution technologies shall have information security-appropriate training. Provide details, including completion dates of this training for all applicable personnel.
2. Asset management
2.1. List the make, model, version of the technology solution components.
2.2. Define the integrations required and the association to the components listed above.
3. Secure solution development and production environment management
3.1. List any in-place security frameworks in the development and production environments, such as NIST, CSC CIS, or ISO.
3.2. List in-place security-related attestations in the development and production environments.
3.3. List all security testing and security controls used for development and on-going security support of your solution.
3.4. List any standard security products supported by your solution, such as anti-malware and application whitelisting.
3.5. Describe your vulnerability management process.
3.6. Describe your security vulnerability notification policy and process.
4. Access control
4.1. Describe the access management capabilities of the proposed solution.
4.2. List the roles that the solution supports.
4.3. List in-place privileged access roles.
4.4. Describe the access required to support the solution.
4.5. Describe how the access control functions support the principles of least privilege and separation of duties.
4.6. Describe how dormant accounts are identified.
4.7. Describe the multi-factor authentication function, if applicable.
4.8. Indicate if an automated data classification function is part of the solution.
4.9. List any integrated directories services such as LDAPs or cloud services such as Okta.
5. Audit logs
5.1. Provide the types of logs included in the solution.
5.2. Indicated if an events interpretation key is available to support identification and analysis of anomalous activity.
5.3. Indicate if these logs are readily consumable by SIEMs such as Splunk.
6. Data Protections and Recovery capabilities
6.1. Describe the protections that provide data confidentiality, integrity, and availability assurance.
6.2. Indicate if detection and alerting on potential data exfiltration is included in the solution.
6.3. Describe the encryption and ciphers included for data at rest and in motion.
6.4. Describe the data recovery ability and the typical recovery timeframe.
6.5. Supply a sample data set that might be required for your solution.
7. Change management
7.1. Describe your internal change management process.
7.2. Describe the communications and timeframe for communications OUC can expect to receive on change management.
7.3. Describe the recourse available to OUC if a planned change is not acceptable.
7.4. Describe the notification OUC can expect to receive if a change causes an issue.
8. Cyber security events
8.1. Provide your breach notification policy and process.
8.2. Indicate if your organization has an incident response plan. If so, provide the plan.
| If a hybrid or a cloud solution is proposed the vendor agrees to: |
| 1. Personnel Security |
| 2. Asset management |
| 3. Secure solution development and production environment management |
| 4. Access control |
| 5. Audit logs |
| 6. Data Protections and Recovery capabilities |
| 7. Change management |
| 8. Cyber security events |
File details come from the government source that posted it. Updated .