Attachment K. - BIT Technology Standards.docx

Attachment K Bureau of Information and Telecommunications Required IT Contract Terms

Any contract resulting from this RFP will include the State’s required IT terms and conditions as listed below, along with any additional terms and conditions as negotiated by the parties. Due to the changing landscape of IT security and data privacy, the State reserves the right to add additional IT terms and conditions or modify the IT terms and conditions listed below to the resulting contract:

Pursuant to South Dakota Codified Law § 1-33-44, the Bureau of Information and Telecommunications ("BIT") oversees the acquisition of office systems technology, software, and services; telecommunication equipment, software, and services; and data processing equipment, software, and services for departments, agencies, commissions, institutions, and other units of state government. As part of its duties as the Executive Branch’s centralized IT agency, BIT requires the contract terms and conditions of this Exhibit XX. For purposes of this Exhibit, [Vendor Name] will be referred to as the “Vendor.”

It is understood and agreed to by all parties that BIT has reviewed and approved only this Exhibit. Due to the ever-changing security and regulatory landscape in IT and data privacy, before renewal of this Agreement BIT must review and approve the clauses found in this Exhibit as being the then current version of the clauses and if any additional required clauses are needed. Changes to clauses in this Exhibit must be approved in writing by all parties before they go into effect and a renewal of this Agreement is possible.

The Parties agree, when used in this Exhibit, the term “Vendor” will mean the Vendor and the Vendor’s employees, subcontractors, agents, assigns, and affiliated entities.

Section I. Password Protection

All aspects of the Vendor’s products provided to the State pursuant to this Agreement will be password protected. If the Vendor provides the user with a preset or default password, that password cannot include any Personally Identifiable Information (PII), data protected under the Family Educational Rights and Privacy Act (FERPA), Protected Health Information (PHI), Federal Tax Information (FTI), or any information defined under federal or state law, rules, or regulations as confidential information or fragment thereof. On an annual basis, the Vendor will document its password policies for all Vendor employees to ensure adequate password protections are in place. The process used to reset a password must include security questions or Multifactor Authentication. Upon request, the Vendor will provide to the State the Vendor’s password policies, logs, or administrative settings to demonstrate the password policies are actively enforced.

Section II. Provision of Data

State Data is any data produced or provided by the State as well as any data produced or provided for the State by the Vendor or a third-party.

Upon notice of termination by either party or upon reaching the end of the term of this Agreement, the Vendor will provide the State all current State Data in a non-proprietary format. In addition, the Vendor agrees to extract any information (such as metadata, which includes data structure descriptions, data dictionary, and data) stored in repositories not hosted on the State’s IT infrastructure in a format chosen by the State. If the State’s chosen format is not possible, the Vendor will extract the information into a text file format and provide it to the State.

Upon the effective date of the termination of this Agreement, the Vendor will again provide the State with all current State Data in a non-proprietary format. In addition, the Vendor will again extract any information (such as metadata) stored in repositories not hosted on the State’s IT infrastructure in a format chosen by the State. As before, if the State’s chosen format is not possible, the Vendor will extract the information into a text file format and provide it to the State.

Section III. Browser

The system, site, or application must be compatible with Vendor supported versions of Edge, Chrome, Safari, and Firefox browsers. Silverlight, QuickTime, PHP, Adobe ColdFusion, and Adobe Flash will not be used in the system, site, or application. Adobe Animate CC is allowed if files that require third-party plugins are not required.

Section IV. Malicious Code

A. The Vendor warrants that the Agreement deliverables contain no code that does not support an application requirement.

B. The Vendor warrants that the Agreement deliverables contains no malicious code.

C. The Vendor warrants that the Vendor will not insert into the Agreement deliverables or any media on which the Agreement deliverables is delivered any malicious or intentionally destructive code.

D. In the event any malicious code is discovered in the Agreement deliverables, the Vendor must provide the State at no charge with a copy of or access to the applicable Agreement deliverables that contains no malicious code or otherwise correct the affected portion of the services provided to the State. The remedies in this Section are in addition to other additional remedies available to the State.

Section V. Web and Mobile Applications

A. The Vendor’s application is required to:

1. have no code or services including web services included in or called by the application unless they provide direct, functional requirements that support the State’s business goals for the application,

2. encrypt data in transport and at rest using a mutually agreed upon encryption format,

3. close all connections and close the application at the end of processing,

4. have documentation that is in grammatically complete text for each call and defined variables (i.e., using no abbreviations and using complete sentences) sufficient for a native speaker of English with average programming skills to determine the meaning or intent of what is written without prior knowledge of the application,

5. have no code not required for the functioning of application,

6. have no “back doors”, a back door being a means of accessing a computer program that bypasses security mechanisms, or other entries into the application other than those approved by the State,

7. permit no tracking of device user’s activities without providing a clear notice to the device user and requiring the device user’s active approval before the application captures tracking data,

8. have no connections to any service not required by the functional requirements of the application or defined in the project requirements documentation,

9. fully disclose in the “About” information that is the listing of version information and legal notices, of the connections made, permission(s) required, and the purpose of those connections and permission(s),

10. ask only for those permissions and access rights on the user’s device that are required for the defined requirements of the Vendor’s application,

11. access no data outside what is defined in the “About” information for the Vendor’s application,

12. conform to Web Content Accessibility Guidelines 2.2 Level AA,

13. have Single Sign On capabilities with the State’s identity provider,

14. have an opening screen that states, in an easy-to-read font, that the application is gathering or accessing health or medical information and the user’s privacy is not protected by federal regulations if any health or medical information is gathered or accessed by the application that is not protected by HIPAA and HITECH rules and regulations, and

15. any application to be used on a mobile device must be password protected.

B. The Vendor is required to disclose all:

1. functionality,

2. device and functional dependencies,

3. third party libraries used,

4. methods user data is being stored, processed, or transmitted,

5. methods used to notify the user how their data is being stored, processed, or transmitted,

6. positive actions required by the user to give permission for their data to be stored, processed and or transmitted,

7. methods used to record the user’s response(s) to the notification that their data is being stored, processed, or transmitted,

8. methods used to secure the data in storage, processing, or transmission,

9. forms of authentication required for a user to access the application or any data it gathers stores, processes and or transmits,

10. methods used to create and customize existing reports,

11. methods used to integrate with external data sources,

12. methods used if integrates with public cloud provider,

13. methods and techniques used and the security features that protect data, if a public cloud provider is used, and

14. formats the data and information uses.

If the application does not adhere to the requirements given above or the Vendor has unacceptable disclosures, at the State’s discretion, the Vendor will rectify the issues at no cost to the State.

Section VI. Data Location and Offshore Services

The Vendor must provide its services to the State as well as storage of State Data solely from data centers located in the continental United States. The Vendor will not provide access to State Data to any entity or person(s) located outside the continental United States that are not named in this Agreement without prior written permission from the State. This restriction also applies to disaster recovery; any disaster recovery plan must provide for data storage entirely within the continental United States.

Section VII. Vendor Training Requirements

The Vendor, Vendor’s employee(s), and Vendor’s subcontractors, agents, assigns, affiliated entities and their employee(s), must successfully complete, at the time of hire and annually thereafter, a cyber-security training program. The training must include but is not limited to:

A. legal requirements for handling data, B. media sanitation, C. strong password protection, D. social engineering, or the psychological manipulation of persons into performing actions that are inconsistent with security practices or that cause the divulging of confidential information, E. security incident response, and F. Protected Health Information.

Section VIII. Data Sanitization

At the end of the project covered by this Agreement the Vendor, and Vendor’s subcontractors, agents, assigns, and affiliated entities will return the State Data or securely dispose of all State Data in all forms, this can include State Data on media such as paper, punched cards, magnetic tape, magnetic disks, solid state devices, or optical discs. This State Data must be permanently deleted by either purging the data or destroying the medium on which the State Data is found according to the methods given in the most current version of NIST 800-88. Certificates of Sanitization for Offsite Data (See bit.sd.gov/vendor/default.aspx for copy of certificate) must be completed by the Vendor and given to the State contact. The State will review the completed Certificates of Sanitization for Offsite Data. If the State is not satisfied by the data sanitization then the Vendor will use a process and procedure that does satisfy the State.

This contract clause remains in effect for as long as the Vendor, and Vendor’s subcontractors, agents, assigns, and affiliated entities have the State Data, even after the Agreement is terminated or the project is completed.

Section IX. Use of Portable Devices

The Vendor must prohibit its employees, agents, affiliates, and subcontractors from storing State Data on portable devices, including personal computers, except for devices that are used and kept only at the Vendor’s data center(s). All portable devices used for storing State Data must be password protected and encrypted.

Section X. Remote Access

The Vendor will prohibit its employees, agents, affiliates, and subcontractors from accessing State Data remotely except as necessary to provide the services under this Agreement and consistent with all contractual and legal requirements. The accounts used for remote access cannot be shared accounts and must include multifactor authentication. If the State Data that is being remotely accessed is legally protected data or considered sensitive by the State, then:

A. The device used must be password protected, B. The data is not put onto mobile media (such as flash drives), C. No non-electronic copies are made of the data, and D. A log must be maintained by the Vendor detailing the data which was accessed, when it was accessed, and by whom it was accessed.

The Vendor must follow the State’s data sanitization standards, as outlined in this Agreement’s Data Sanitization clause, when the remotely accessed data is no longer needed on the device used to access the data.

Section XI. Data Encryption

If State Data will be remotely accessed or stored outside the State’s IT infrastructure, the Vendor warrants that the data will be encrypted in transit (including via any web interface) and at rest at no less than AES256 level of encryption with at least SHA256 hashing.

Section XII. Third Party Hosting

If the Vendor has the State’s data hosted by another party, the Vendor must provide the State the name of this party. The Vendor must provide the State with contact information for this third party and the location of their data center(s). The Vendor must receive from the third party written assurances that the State’s data will always reside in the continental United States and provide these written assurances to the State. This restriction includes the data being viewed or accessed by the third-party’s employees or contractors. If during the term of this Agreement the Vendor changes from the Vendor hosting the data to a third-party hosting the data or changes third-party hosting provider, the Vendor will provide the State with 180 days’ advance notice of this change and at that time provide the State with the information required above.

Section XIII. Securing of Data

All facilities used to store and process State Data will employ industry best practices, including appropriate administrative, physical, and technical safeguards to secure such data from unauthorized access, disclosure, alteration, and use. Such measures will be no less protective than those used to secure the Vendor’s own data of a similar type, and in no event less than commercially reasonable in view of the type and nature of the data involved.

Section XIV. Security Processes

The Vendor will disclose its non-proprietary security processes and technical limitations to the State such that adequate protection and flexibility can be attained between the State and the Vendor. For example: virus checking and port sniffing.

Section XV. Import and Export of Data

The State will have the ability to import or export data piecemeal or in entirety at its discretion without interference from the Vendor. This includes the ability for the State to import or export data to/from other vendors.

Section XVI. Security Scan Report

The Vendor will provide the State, at no cost to the State, and at a date and time and for the duration agreeable to both parties, a security scan report of the Vendor’s system and data. The security scan report will include mutually agreed to information. The security scan report must show an acceptable security, as defined by the State. At the Vendor’s sole expense, the Vendor will work with the State to rectify any Critical and High security defects indicated by the security scan prior to the State engaging the Vendor. After rectifying the security defects, the Vendor will provide the State a scan that demonstrates that the security defects were rectified, to the State’s satisfaction, at no additional cost to the State. The State may collaborate, at the State’s discretion, with the Vendor on remediation efforts. These remediation efforts will not be considered a violation of any licensure agreements between the State and the Vendor. The State will not be charged for any costs incurred by the Vendor in these remediation efforts unless agreed to by the State in advance and in writing. Security defects are defined to be:

A. Critical – Exploitation of the vulnerability likely results in root-level compromise of servers or infrastructure devices.

B. High – The vulnerability is difficult to exploit; however, it is possible for an expert in Information Technology. Exploitation could result in elevated privileges.

Section XVII. System Upgrades

The Vendor must provide advance notice of 30 days to the State of any major upgrades or system changes the Vendor will be implementing unless the changes are for reasons of security. A major upgrade is a replacement of hardware, software, or firmware with a newer or improved version, in order to bring the system up to date or to improve its characteristics. The State reserves the right to postpone these changes unless the upgrades are for security reasons. The State reserves the right to scan the Vendor’s systems for vulnerabilities after a system upgrade. These vulnerability scans can include penetration testing of a test system at the State’s discretion.

Section XVIII. Movement of Protected State Data

Any State Data that is protected by federal or state statute or requirements or by industry standards must be kept secure. When protected State Data is moved to any of the Vendor’s production or non-production systems, security must be maintained. The Vendor will ensure that that data will at least have the same level of security as it had on the State’s environment.

Section XIX. Banned Services

The Vendor warrants that any hardware or hardware components used to provide the services covered by this Agreement were not manufactured by Huawei Technologies Company, Nuctech, or ZTE Corporation, or any subsidiary or affiliate of such entities. Any company considered to be a security risk by the government of the United States under the International Emergency Economic Powers Act or in a United States appropriation bill will be included in this ban.

Section XX. Multifactor Authentication for Hosted Systems

If the Vendor is hosting on their system or performing Software as a Service where there is the potential for the Vendor or the Vendor’s subcontractor to see protected State Data, then Multifactor Authentication (MFA) must be used before this data can be accessed. The Vendor’s MFA, at a minimum must adhere to the requirements of Level 2 Authentication Assurance for MFA as defined in NIST 800-63.