Attachment H - Data Security Requirements.pdf

Attachment H

Data Security Requirements

1. CHAPTER 60GG-1, F.A.C. – INFORMATION TECHNOLOGY PROJECT

MANAGEMENT AND OVERSIGHT STANDARDS

Chapter 60GG-1, Florida Administrative Code F.A.C., Florida Information Technology Project Management and Oversight Standards, establishes project management principles that State Agencies are required to follow when implementing information technology projects. The Agency must adhere to the State project management standards and ensure that all project documentation created by the Vendor, the Agency, or in collaboration, is developed and maintained in accordance with 60GG-1, F.A.C. The Vendor must be familiar with the State project management standards and be prepared to satisfy all requirements. It is important for the Vendor to recognize that documentation, monitoring, or reporting requirements may change mid-project, based on the project’s FL[DS] Risk and Complexity Assessment, outlined in Rule 60GG-1.002. The Vendor must be adaptable to changes required by 60GG-1 F.A.C., without increasing cost to the Agency.

2. CHAPTER 60GG-2, F.A.C. – FLORIDA CYBERSECURITY STANDARDS

Chapter 60GG-2 F.A.C., Information Technology Security, also known as the Florida Cybersecurity Standards (FCS), establishes cybersecurity standards for information technology (IT) resources. State Agencies are required to follow these standards in the management and operations of state IT resources. The Agency must adhere to the Florida Cybersecurity Standards for all IT projects created by the Vendor, Agency, or in collaboration. The Vendor must adhere to, including items like responsibilities pertaining to data breaches. External service providers must adhere to agency security policies..

3. CHAPTER 60GG-2.002, – F.A.C. BACKGROUND CHECKS FOR VENDOR

STAFF

The Agency requires Vendor employees to perform background checks and ensuring that a background investigation is performed on all individuals hired as IT Workers with access to information processing facilities, or who have system, database, developer, network, or other administrative capabilities for systems, applications, or servers with risk categorization of moderate-impact or higher. These positions often, if not always, have privileged access. As such, in addition to Agency-required background screening, background checks conducted by the Vendor must include a federal criminal history check that screens for felony convictions that concern or involve the following:

a. Computer related or IT crimes;

https://www.flrules.org/gateway/ChapterHome.asp?Chapter=60GG-1 https://www.flrules.org/gateway/ChapterHome.asp?Chapter=60GG-2

b. Identity theft crimes;

c. Financially-related crimes, such as: fraudulent practices, false pretenses and frauds, credit card crimes;

d. Forgery and counterfeiting;

e. Violations involving checks and drafts;

f. Misuse of medical or personnel records; and,

g. Theft.

The Agency will establish appointment selection disqualifying criteria for individuals hired as IT Workers that will have access to information processing facilities, or who have system, database, developer, network, or other administrative capabilities for systems, applications, or servers with risk categorization of moderate-impact or higher.