Attachment D- Security Plan.docx

Attachment D: System Security Plan RFR_173024

Attachment D: System Security Plan

Bidders must provide responses to the following questions regarding the development, testing, implementation, and operation of the proposed solution. Bidders may cross-reference to other areas of their response for supporting details, but a stand-alone answer to these questions is required. Responses should be concise and accurate, and follow the requested format. Unnecessary samples, attachments, or documents not specifically asked for should not be submitted.

The System Security Plan describes the administrative, technical, and physical controls that will ensure the confidentiality, integrity, and availability of the data within PACS System. This document will be updated in response to system updates, enhancements, changes to infrastructure, or as otherwise deemed necessary.

Your response must follow the same named control or requirement below. Alternatively, reference and append any related documentation that will describe the control/requirement. If a control is inapplicable, please describe why, including any risk mitigating strategies.

1. System Description Briefly describe the system, and its purpose. Reference any relevant supporting documentation that will provide a more detailed description of the current system and its migration path (e.g., Vision Document, System Architecture Document).

2. Data Sources List all originating sources of system data, including system interfaces. Describe whether data maintained in the system is otherwise disclosed/shared with other systems. Is the data itself (or categories of data) described in the PACS system documentation?

3. Remote File Transfer Describe the primary method whereby secure file transfers are performed as part of initial system setup, routine maintenance, or emergency system restoration.

4. Contingency Planning And Disaster Recovery Planning Describe the contingency plan(s) and disaster plan(s). Discuss arrangements and safeguards to ensure the alternate processing site that will provide an adequate operational level of information assurance and business continuity, should an outage at the primary location occur. Describe backup procedures at this alternate processing site. Describe the full range of backup procedures and the physical location of stored backup tapes or other media. Describe the generations of backups kept i.e. the backup strategy (e.g. grandfather, father, son method) specify data/system backup retention periods.

5. Hardware, Operating System, And System Software Maintenance Controls Describe the security controls used to monitor the installation and updates to hardware, operating system software, and other system software to ensure that the hardware and software functions as expected and that a historical record is maintained of system changes.

6. Data Integrity/Validation Controls Describe data integrity controls for the systems to prevent/detect destruction or unauthorized data modification, including controls used to protect the information, operating system, application, and other system software (including security software) from accidental or malicious destruction or alteration.

7. Documentation List the existing documentation that describes the system, its components, maintenance procedures, and general use. Include the title, date, and the office responsible for maintaining the documentation (e.g., System Architecture Document, Customer Support).

8. Security Policies Awareness And Training (Sat) Describe the system specific security policies and training for all users who are involved with its management, use, or operation. List the types and frequency of system-specific training recommended and how the training will be conducted. Explain what roles within the client organization should receive the policy and operational training on the system (e.g., medical vs. non-medical staff).

Technical Controls In the sub-sections below, describe how the following technical controls have been implemented for the system. Discuss the logical controls in place to authorize or restrict the activities of users and information technology personnel within the system.

9. Identification And Authentication Controls Describe user identification and authentication controls for the system, including mechanisms that provide the ability to verify users. If the system uses application specific passwords, describe in detail the characteristics of the passwords, (e.g., minimum & maximum length, character set limits/requirements, password aging). Describe features that would enable connecting the system to external authentication systems such as those that may be compatible with Microsoft Active Directory system approaches (e.g. LDAP) or generic PKI systems and state whether authentication connections are encrypted using technologies such as TLS.

10. Encryption And Integrity Describe encryption types for transport to and storage on the system. Be sure to include any specific system hardware or software features (e.g., HTTPS, 3DES, AES) used to encrypt data while at either rest or in transit. Please provide a description of how encryption and integrity are implemented.

11. Web Services And Interfaces Describe if Web Services are used, and if so, how these are secured. Provide the security architecture for the system and recommended complementary security appliances. Additionally, describe any additional system interfaces and how these are secured to prevent unauthorized access to information contain therein. Reference related system documentation as appropriate.

12. Application Security Testing Describe processes that exist for the reviewing application for security defects (e.g., cross-site scripting), prior to, and during the code development phase (white box testing) as well as application testing or programs after they are functional (black box testing) and ready for deployment in client facilities. Please note that your system will have to be scanned for vulnerabilities prior to deployment as part of routine procedures in State server rooms and that this scan may be performed prior to system purchase (remotely, with the system situated at your facilities).

13. Infrastructure Security Testing And Monitoring Describe the technical processes and tools for ensuring the security of any infrastructure associated with the application. As an example, are servers hardened, and is penetration testing performed prior to deployment at customer sites.

14. Authorization And Access Controls Describe user authorization and access controls for the system. Be sure to include any specific system hardware or software features (e.g., Access Control Lists [ACL]) used to control access to the system resources by defining which users (or system components) can access which resources. A description must be included indicating how users (in various roles) request and are approved for access to the system. Describe any system specific warning/notice banners. Provide a screen image of any system specific warning banners or notices of configuration criticality or data sensitivity. Describe if the system includes Super users, and any associated controls for tracking their changes.

15. Remote Users And Dial-Up Controls Describe the type of remote access (e.g., VPN, Internet, dial-up) supported and the functions available for remote use (e.g., e-mail only, data retrieval only, full access).

16. Wide Area Networks (Wan) Controls Describe WAN security controls for the system. If the system is connected to the Internet or other wide area network(s), discuss what additional hardware or technical controls have been installed and implemented to provide protection against unauthorized system penetration and other known Internet threats and vulnerabilities (e.g., VPN, Network Firewalls, IDS).

17. Audit Trails Describe the auditing mechanism controls to allow management to conduct an independent review of recent activities. Include what is recorded, who reviews the audit trail, how often it is reviewed, and what procedures are employed for corrective actions as a result of a finding. Describe when audit trails are employed (e.g., on a given cycle, continuously, when an incident occurs, etc.). Describe the audit trail archive procedures, including how long they are kept, where they are stored, and what media type they are stored on.