The file's text, extracted by GovTribe without its formatting.
Attachment E Seed to Sale Tracking System and Resources - IT Governance and Legal Requirements Section I – Instructions
Please read this entire Attachment and provide the confirmation that the proposed solution will comply with every requirement below. All signatures should be submitted with the technical response as part of Packet I.
This Attachment contains IT Governance and Legal Requirements the Department has identified and their related data. Offerors shall notify the Department if they cannot comply with any of the identified IT specifications and shall also notify the Department of any IT Governance and Legal Requirements the Offeror believes should have been included. The Department encourages innovation and enhancements and welcomes the Offerors to highlight their proposed solution's innovation. The documented specifications are State standard requirements for third-party solutions and are consistent with any State of Illinois Department of Innovation and Technology contract.
Section II – IT Governance and Legal Requirements
IT GOVERNANCE AND LEGAL REQUIREMENTS
| ID# |
| Category |
| Requirement Description |
| Notes |
| NF.1 |
| Accessibility |
| Awarded Vendor must ensure that all information technology, including electronic information, software, systems and equipment, developed, or provided under this contract complies with the applicable requirements of the Illinois Information Technology Accessibility Act Standards as published at www.dhs.state.il.us/iitaa (30 ILCS 587). |
| www.dhs.state.il.us/iitaa |
| NF.2 |
| Credentialing |
| Awarded Vendor’s system must have the ability to interface with the State’s Identity and Access Management solutions if credentialing is required |
| NF.3 |
| Credentialing |
| Awarded Vendor’s system must have the ability to log activity within the system and have the ability to forward log information to the State’s security incident and event management system (SIEM). Awarded Vendor must meet the State of Illinois’ Minimum Logging Requirements. |
| See Section III – Minimum Logging Requirements for details |
| NF.4 |
| Data |
| Awarded Vendor must only use State of Illinois data for the purposes stated in this contract. |
| NF.5 |
| Data |
| Awarded Vendor must provide a copy of all data to the State without delay upon request by the State. |
| NF.6 |
| Data |
| Awarded Vendor must provide a copy of all data to the State prior to termination of contract. |
| NF.7 |
| Data |
| Awarded Vendor must sanitize all media that contained State of Illinois data. Awarded Vendor must use the current revision of NIST Special Publication 800-88; Guidelines for Media Sanitization. Awarded Vendor must provide certification of media sanitization including the method, date and time. |
| NIST SP 800-88 Rev. 1 |
| NF.8 |
| Data Storage |
| Awarded Vendor must ensure all hosted data pertinent to this contract remains located within the contiguous United States. |
| NF.9 |
| Data Storage |
| Awarded Vendor must maintain a robust and reliable data backup system. Awarded Vendor must supply a description of backup methodology and this methodology must meet defined MTD and RPO requirements. |
| MTD - The maximum amount of time an application or data can be unavailable to users |
RPO - The maximum allowable age of the most recent data backup.
| NF.10 |
| Data Storage |
| Awarded Vendor must ensure that production data is not used outside of the production environment. |
| NF.11 |
| Data Storage |
| Awarded Vendor must store data in a non-proprietary format or Awarded Vendor must provide a solution at no additional cost to the State to extract any State of Illinois data stored in Awarded Vendor’s solution. |
| NF.12 |
| Data Storage |
| Awarded Vendor certifies that its hosting platform is FedRAMP certified |
| NF.13 |
| Disaster Recovery |
| Awarded Vendor must provide a disaster recovery methodology and provide proof of annual disaster recovery testing, including issues discovered and remediation plans for the issues discovered. |
| NF.14 |
| Encryption |
| Awarded Vendor must ensure encryption of State of Illinois data at rest and in motion. This encryption must comply with encryption security controls as defined in the most current version of FIPS 140 using AES encryption with a minimum key length of 256 bits. Awarded Vendor must provide proof of encryption. Awarded Vendor must provide the State with the capabilities to manage encryption keys. |
| NF.15 |
| Governance |
| Awarded Vendor program and project management personnel must ensure coordination of activities with State of Illinois Governance program. Awarded Vendor must comply will all policies, standards and procedures defined by the State of Illinois’ Department of Innovation and Technology’s Enterprise Portfolio Management Office. |
| NF.16 |
| Regulations |
| Awarded Vendor must comply with all Federal and State laws, rules and regulations, which includes, but are not limited to: Illinois Identity Protection Act (5 ILCS 179). |
| Illinois Identity Protection Act (5 ILCS 179) |
| NF.17 |
| Regulations |
| Awarded Vendor must comply with all Federal and State laws, rules and regulations, which includes, but are not limited to: Illinois Personal Information Protection Act (815 ILCS 530). |
| Illinois Personal Information Protection Act (815 ILCS 530) |
| NF.18 |
| Regulations |
| Awarded Vendor must comply with all Federal and State laws, rules and regulations, which includes, but are not limited to: Illinois Freedom of Information Act (5 ILCS 140). |
| Illinois Freedom of Information Act (5 ILCS 140) |
| NF.19 |
| Regulations |
| Awarded Vendor must comply with all Federal and State laws, rules and regulations, which includes, but are not limited to: Health Insurance Portability and Accountability Act (HIPAA). |
| Health Insurance Portability and Accountability Act (HIPAA) |
| NF.20 |
| Regulations |
| Awarded Vendor must comply with all Federal and State laws, rules and regulations, which includes, but are not limited to: Health Information Technology (HITech). |
| Health Information Technology (HITech) |
| NF.21 |
| Risk Assessment |
| Awarded Vendor certifies it has undertaken independent third-party audit Statement on Standards for Attestation Engagements (SSAE-18) certifications and must provide the State of Illinois with a System Operation Controls report (SOC 2 type 2)) annually and applicable bridge/gap letter. |
| NF.22 |
| Risk Assessment |
| Awarded Vendor must participate in an annual risk assessment and data classification and system categorization process. The formal risk assessment will be administered by the State of Illinois. |
| NF.23 |
| Risk Assessment |
| Awarded Vendor must provide a Plan of Action and Milestones (POA&M) to the State of Illinois that addresses any control deficiencies identified during the State of Illinois’ risk assessment, review of the Awarded Vendor’s SOC report/s, 3rd party assessment, internal security controls assessment. The POA&M should describe the deficiencies in the security controls, address the residual risk and detail plans for remediation. Awarded Vendor must provide the State of Illinois monthly updates regarding progress toward remediation of identified deficiencies. |
| See Section IV - Plan of Actions and Milestones Template for details |
| NF.24 |
| Security |
| Awarded Vendor will notify the State's Chief Information Security Officer within 24 hours of any information breach or other security incident which impacts the State's data. |
| NF.25 |
| Security |
| Awarded Vendor shall have a documented security incident policy and plan. Awarded Vendor must supply a copy at the request of the State of Illinois. |
| NF.26 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Acceptable Use. |
| Acceptable Use Policy |
| NF.27 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Access Control. |
| Access Control Policy |
| NF.28 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Accountability, Audit, and Risk Management Privacy Policy. |
| Accountability, Audit, and Risk Management Privacy Policy |
| NF.29 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Audit and Accountability Policy. |
| Audit and Accountability Policy |
| NF.30 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Awareness and Training Policy. |
| Awareness and Training Policy |
| NF.31 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Configuration Management Policy. |
| Configuration Management Policy |
| NF.32 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Contingency Planning Policy. |
| Contingency Planning Policy |
| NF.33 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Data Minimization and Retention Privacy Policy. |
| Data Minimization and Retention Privacy Policy |
| NF.34 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Data Quality and Integrity Privacy Policy. |
| Data Quality and Integrity Privacy Policy |
| NF.35 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: FTI Supplemental Policy. |
| FTI Supplemental Policy |
| NF.36 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Identification and Authentication Policy. |
| Identification and Authentication Policy |
| NF.37 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Individual Participation and Redress Privacy Policy. |
| Individual Participation and Redress Privacy Policy |
| NF.38 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Information Security Incident Management Policy. |
| Information Security Incident Management Policy |
| NF.39 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Media Protection Policy. |
| Media Protection Policy |
| NF.40 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Overarching Enterprise Information Security Policy. |
| Overarching Enterprise Information Security Policy |
| NF.41 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: PCI Data Security Policy. |
| PCI Data Security Policy |
| NF.42 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Personnel Security Policy. |
| Personnel Security Policy |
| NF.43 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: PHI Supplemental. |
| PHI Supplemental |
| NF.44 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Physical and Environmental Protection Policy. |
| Physical and Environmental Protection Policy |
| NF.45 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Privacy Security Policy. |
| Privacy Security Policy |
| NF.46 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Program Management Policy. |
| Program Management Policy |
| NF.47 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Risk Assessment Policy. |
| Risk Assessment Policy |
| NF.48 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Security Assessment and Authorization Policy. |
| Security Assessment and Authorization Policy |
| NF.49 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Security Planning Policy. |
| Security Planning Policy |
| NF.50 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: System and Communication Protection Policy. |
| System and Communication Protection Policy |
| NF.51 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: System and Information Integrity Policy. |
| System and Information Integrity Policy |
| NF.52 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: System and Services Acquisition Policy. |
| System and Services Acquisition Policy |
| NF.53 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: System Maintenance Policy. |
| System Maintenance Policy |
| NF.54 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Transparency, Authority, and Purpose Privacy Policy. |
| Transparency, Authority, and Purpose Privacy Policy |
| NF.55 |
| Security |
| Awarded Vendor ensures it has the following documented security policy similar to the State of Illinois Enterprise Security Policy: Use Limitation Privacy Policy. |
| Use Limitation Privacy Policy |
| NF.56 |
| Security |
| Awarded Vendor and/or its agents must not resell nor otherwise redistribute information gained from its access to the State or Participants. |
| NF.57 |
| Security |
| Awarded Vendor must not engage in nor permit its agents to push adware, software, or marketing not explicitly authorized by the State. |
| NF.58 |
| Security |
| Awarded Vendor must allow the State of Illinois to perform vulnerability assessments. |
| See Section V – Vulnerability Assessment for details |
| NF.59 |
| Security |
| Awarded Vendor must remediate critical, high and medium vulnerabilities within the application that are detected during the security assessments and are determined by the State of Illinois to pose an unacceptable risk. |
| NF.60 |
| Security |
| Awarded Vendor must secure independent 3rd party penetration testing annually according to Cloud Security Alliance (CSA) and Open Web Application Security Project (OWASP) recommendations. Awarded Vendor must supply the results of the testing to the State of Illinois upon request. |
Section III – Minimum Logging Requirements
· Input validation failures e.g., protocol violations, unacceptable encodings, invalid parameter names and values
· Output validation failures e.g., database record set mismatch, invalid data encoding
· Authentication successes and failures
· Authorization (access control) failures
· Session management failures e.g., cookie session identification value modification
· Application errors and system events e.g., syntax and runtime errors, connectivity problems, performance issues, third party service error messages, file system errors, file upload virus detection, configuration changes
· Application and related systems start-ups and shutdowns, and logging initialization (starting, stopping or pausing)
· Use of higher-risk functionality e.g. network connections, addition or deletion of users, changes to privileges, assigning users to tokens, adding or deleting tokens, use of systems administrative privileges, access by application administrators, all actions by users with administrative privileges, access to payment cardholder data, use of data encrypting keys, key changes, creation and deletion of system-level objects, data import and export including screen-based reports, submission of user-generated content - especially file uploads
· Legal and other opt-ins e.g., permissions for mobile phone capabilities, terms of use, terms & conditions, personal data usage consent, permission to receive marketing communications
Section IV – Plan of Actions and Milestones Template
| Identified Deficiency |
| Residual Risk |
| Detailed Remediation Plan |
Section V – Vulnerability Assessment
· Awarded Vendor must obtain cloud hosting Awarded Vendor’s approval on behalf of the State of Illinois to perform vulnerability assessments on the cloud hosted website/s.
· Awarded Vendor must execute the State of Illinois Vulnerability Scanning Agreement prior to vulnerability assessment.
(See DoIT Scanning Agreement)
· State of Illinois may with reasonable notice to Awarded Vendor, conduct a security assessment of Awarded Vendor’s solution which may include the following;
· Prior to initial “Official” production role out of the application,
· Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application.
· Manual verification of scan results with the same credentials
· Manual testing of the application for vulnerabilities
· State of Illinois will not conduct any Denial of Service (DOS) attacks
· State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)
· On a quarterly basis for the for the first year after initial production deployment;
· Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application.
· Manual verification of scan results with the same credentials
· Manual testing of the application for vulnerabilities
· State of Illinois will not conduct any DOS attacks
· State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)
· Prior to any enhancements or upgrades being deployed to production after the initial “official” production role out of the application,
· Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application.
· Manual verification of scan results with the same credentials
· Manual testing of the application for vulnerabilities
· State of Illinois will not conduct any DOS attacks
· State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)
· Monthly vulnerability scan – no whitelisting, non-credentialed scan (same day every month).
DoIT Scanning Agreement DDDDddd
Section VI – Signature
The undersigned certifies that the Offeror has read the above list and shall comply with all identified IT specifications listed in this Attachment E.
| Signature: _______________________________________ |
| Date: Click or tap to enter a date. |
| Printed Name: Click here to enter text. |
| Title: Click here to enter text. |
image1.jpg