About this file
This is a Cloud Hosting Terms and Conditions attachment for the Illinois Department of Transportation's (IDOT) Construction and Materials Management System (CMMS) Modernization procurement. The document establishes the technical, security, and operational requirements that the selected vendor must meet for hosting the CMMS as a commercial off-the-shelf (COTS) Software as a Service (SaaS) solution. The vendor is required to provide service desk support during regular business hours (7:00 AM to 5:00 PM CST, Monday through Friday) with emergency contact availability outside these hours, and must maintain 99.9% system availability 24/7. The vendor must establish documented policies for service desk management, defect handling, escalation procedures, patch management, and system maintenance with advance notification and State approval for any downtime. Performance objectives including response time, load speed, concurrent users, and transaction processing speed will be defined by IDOT and the vendor following contract award and prior to execution.
The vendor must comply with comprehensive security requirements including Federal and State of Illinois laws, regulations, and all Enterprise Security Policies. Key security obligations include obtaining SOC 2 Type 2 certification with annual reporting, completing an Authority to Operate (ATO) or Authority to Connect (ATC) packet annually, implementing FIPS 140-2 compliant encryption with 256-bit AES for data at rest and in motion, maintaining data exclusively within the contiguous United States, and participating in annual risk assessments and vulnerability testing. The vendor must notify the State's Chief Information Security Officer within 24 hours of any data breach, maintain robust disaster recovery and backup systems, provide data in non-proprietary formats upon request, sanitize all media containing State data using NIST SP 800-88 standards, and perform continuous monitoring per NIST SP 800-137. Additionally, the vendor must integrate with the State's OKTA identity management system, forward security logs to the State's SIEM, conduct third-party penetration testing, remediate critical and high vulnerabilities immediately, and provide monthly security status reports documenting monitoring activities and remediation efforts.
View the file
Other files
Show all 14
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Attachment F: Cloud Hosting Terms and Conditions
Illinois Department of Transportation Cloud Hosting Terms and Conditions
1. Vendor must provide service desk support to the agency during regular business hours of 7:00 am to 5:00 PM CST, Monday through Friday. A contact for emergency requests outside of the designated hours must also be provided. The vendor must describe their proposed policy for service desk support, support request management, defect handling, recurring issues identification and escalation procedures.
2. The application must be available 24 hours a day, 7 days a week and meet or exceed the Service Availability SLO Target defined as 99.9% up-time for the Service. The vendor will produce a monthly service availability report upon request.
3. The vendor must document critical security patch, maintenance patch and release management standards, identifying who applies those patches, sequence of application to non-production and production and notifications of any downtime if applicable or for required testing. Any downtime for system maintenance or release activities should occur outside of business hours and the department must be notified and approve in advance.
4. The application must meet performance objectives including response time, load speed, concurrent users, and transaction processing speed. Performance objectives will be defined by the Department and the Vendor following contract award and prior to contract execution.
5. Vendor will notify the State of Illinois’ Chief Information Security Officer within 24 hours of knowledge of any information breach or other security incident which impacts State of Illinois data. Email notification to: DoIT.Security@illinois.gov and Subject Line should state “Breach Notification.”
6. Vendor shall have a documented security incident policy and plan. Vendor must supply a copy at the request of the State of Illinois.
7. Vendor must comply with all United States Federal and State of Illinois laws, rules, and regulations.
8. Vendor must comply with all of the State of Illinois Enterprise Security Policies (https://www2.illinois.gov/sites/doit/support/policies/Pages/default.aspx).
9. Vendor must ensure that all information technology, including electronic information, software, systems and equipment, developed or provided under this contract complies with the applicable requirements of the Illinois Information Technology Accessibility Act Standards as published at (https://doit.illinois.gov/accessibility/iitaa). 30 ILCS 587. If available, Vendor must provide the State of Illinois their most recent Voluntary Product Accessibility Template (VPAT).
10. Vendor program and project management personnel must ensure coordination of activities with the State of Illinois governance program. Vendor must comply with all policies, standards, and procedures defined by the State of Illinois Department of Innovation and Technology’s Enterprise Portfolio Management Office.
11. Vendor’s system must interface with the State of Illinois’ identity and access management solutions if authentication is required for access to the system (currently OKTA).
12. Vendor’s system must log activity within the system and have capacity to forward log information to the State of Illinois’ security incident and event management system (SIEM). Vendor must meet the State of Illinois’ Minimum Logging Requirements for the term of the Contract.
12.1. (See Security Appendix S1)
13. Vendor certifies it has undertaken independent third-party audit Statement on Standards for Attestation Engagements (SSAE-18) certifications and must provide the State of Illinois with a System Operation Controls report (SOC 2 type 2) annually and applicable bridge/gap letter.
14. Vendor must participate in an annual risk assessment and data classification and system categorization process. The formal risk assessment will be administered by the State of Illinois.
15. Vendor must provide a Plan of Action and Milestones (POA&M) to the State of Illinois that addresses any control deficiencies identified during the State of Illinois’ risk assessment, review of Vendor’s SOC report(s), third-party assessment, and internal security controls assessment. The POA&M should describe the deficiencies in the security controls, address the residual risk, and detail plans for remediation. Vendor must provide the State of Illinois monthly updates regarding progress toward remediation of identified deficiencies.
15.1. (See Security Appendix S3)
16. Vendor must complete and provide the State of Illinois an Authority to Operate (ATO) or Authority to Connect (ATC) packet at the State of Illinois’ request. This packet must be renewed annually.
16.1. (See Security Appendix S4)
17. Vendor must ensure all hosted data pertinent to this contract shall remain located within the contiguous United States.
18. Vendor must ensure encryption of State of Illinois data at rest and in motion. This encryption must comply with encryption security controls as defined in the most current version of the Federal Information Processing Standard (FIPS) 140 using Advanced Encryption Standard (AES) encryption with a minimum key length of 256 bits. Vendor must provide proof of encryption. Vendor must provide the State of Illinois with the capabilities to manage encryption keys for data at rest.
19. Vendor must store data in a non-proprietary, readily accessible format, or Vendor must provide a solution, at no additional cost to the State of Illinois, to extract any State of Illinois data stored in Vendor’s solution.
20. Vendor must only use State of Illinois data, for the purposes stated in this contract.
21. At the State’s request, Vendor must provide a written disaster recovery methodology and provide proof of annual disaster recovery testing, including issues discovered and remediation plans for the issues discovered.
21.1. Vendor must maintain a robust and reliable data backup system. Vendor must supply a description of backup methodology, and this methodology must meet defined Maximum Tolerable Downtime (MTD) and Return to Operations (RPO) requirements.
22. Vendor may not use any State of Illinois data in any non-production system or in any other system outside the application/service procured under this contract.
23. Vendor must provide a copy of all State of Illinois data (in a non-proprietary format) to the State of Illinois without delay upon request by the State of Illinois.
24. Vendor must provide a copy of all State of Illinois data (in a non-proprietary format) to the State of Illinois prior to termination of contract.
25. Vendor must sanitize all media that contains or contained State of Illinois data. Vendor must use the more current revision of NIST Special Publication 800-88; Guidelines for Media Sanitization. Vendor must provide the State of Illinois with a written certification of media sanitization including the method, date and time.
26. Vendor must use a form of “crypto shredding” acceptable to the State of Illinois for rendering all State of Illinois data hosted by the Vendor inaccessible after a copy of all data has been provided to the State of Illinois.
27. Vendor and/or its agents must not resell nor otherwise redistribute information gained from its access to the State of Illinois data.
28. Vendor must not engage in nor permit its agents to push adware, software, or marketing not explicitly authorized by the State of Illinois.
29. Vendor must allow the State of Illinois to perform vulnerability assessments.
29.1. (See Security Appendix S5)
30. Vendor must immediately remediate critical, high, and medium vulnerabilities within the application that are detected during the security assessments and are determined by the State of Illinois to pose an unacceptable risk.
31. Vendor must secure independent third-party penetration testing at regular intervals, in accordance with Cloud Security Alliance (CSA) and Open Web Application Security Project (OWASP) recommendations. Vendor must supply the results of the testing to the State of Illinois upon request.
32. Vendor must supply a list of all non-proprietary/open source software used in their solution. Vendor must also include the version and Open Source Initiative (OSI) approved license type used for any open source software. If Open Source uses non-OSI approved licensing Vendor must include licensing terms and conditions.
Security Appendix S1 – Minimum Logging Requirements
· Input validation failures (e.g., protocol violations, unacceptable encodings, invalid parameter names and values)
· Output validation failures (e.g., database record set mismatch, invalid data encoding)
· Authentication successes and failures
· Authorization (access control) failures
· Session management failures (e.g., cookie session identification value modification)
· Application errors and system events (e.g., syntax and runtime errors, connectivity problems, performance issues, third-party service error messages, file system errors, file upload virus detection, configuration changes)
· Application and related systems start-ups and shut downs, and logging initialization (starting, stopping, or pausing)
· Use of higher-risk functionality (e.g., network connections, addition or deletion of users, changes to privileges, assigning users to tokens, adding or deleting tokens, use of systems administrative privileges, access by application administrators, all actions by users with administrative privileges, access to payment cardholder data, use of data encrypting keys, key changes, creation and deletion of system-level objects, data import and export including screen-based reports, submission of user-generated content - especially file uploads)
· Legal and other opt-ins (e.g., permissions for mobile phone capabilities, terms of use, terms & conditions, personal data usage consent, permission to receive marketing communications)
Security Appendix S3 - Plan of Actions and Milestones Template
| Identified Deficiency |
| Residual Risk |
| Detailed Remediation Plan with Timeline |
| Expected Completion Date |
Security Appendix 4 – Authority to Operate / Authority to Connect Packet
Security Appendix S5 – Authority Packet STATE OF ILLINOIS NIST and FISMA Compliance Document Project Name:
Date:
Duration of Project:
Vendor Name:
Vendor Contact Information:
A. The departments and agencies within all branches of the Federal Government are required by Federal Information Security Modernization Act (FISMA) of 2014 to comply with OMB E-GOV guidance to provide information security for the information and information systems that support the operations and assets under their control. The Federal Office of Management and Budget (OMB) has published guidance for the executive branch in OMB Circulars A-123, Appendix D and A-130.
B. STATE OF ILLINOIS recognizes that FISMA compliance, effective information security management, and continuous monitoring of information systems are paramount to the success of information technology (IT) systems. In order to establish an information security program in accordance with FISMA, Vendor must follow the National Institute for Standards and Technology (NIST) Guidelines of the NIST Risk Management Framework (RMF), as amended.
C. Requirements
(1) Each requirement in the table below is understood to contain the implied prefix, " Vendor shall..."
| Area |
| Requirement ID |
| Description |
| NIST and FISMA Compliance |
| 1 |
| Describe in detail how Vendor will meet all NIST and FISMA requirements before the solution or projects approved for production. |
VENDOR RESPONSE:
| NIST and FISMA Compliance |
| 2 |
| Describe in detail how Vendor will define information system boundaries for authorization. |
VENDOR RESPONSE:
| NIST and FISMA Compliance |
| 3 |
| Describe in detail how Vendor will assess, review, and evaluate the information systems to be implemented based upon security categorization in accordance with Federal Information Processing Standards (FIPS) Publication 199 Standards for Security Categorization of Federal Information and Information Systems. Additional guidance on defining the information type can be obtained from National Institute Technological Standards (NIST) SP 800-60. |
VENDOR RESPONSE:
| NIST and FISMA Compliance |
| 4 |
| Describe in detail how Vendor will select the baseline controls described in FIPS 200 and NIST SP 800-53 to develop a System Security Plan (SSP). |
VENDOR RESPONSE:
| NIST and FISMA Compliance |
| 5 |
| Describe in detail how Vendor will meet security requirements with regard to protecting the confidentiality, integrity, and availability of the system and the information processed, stored, and transmitted by the system. |
VENDOR RESPONSE:
| NIST and FISMA Compliance |
| 6 |
| Describe in detail how Vendor will perform continuous monitoring of the system in compliance with NIST SP 800-137. |
VENDOR RESPONSE:
| (2) Vendor shall provide the following System Security Plan (SSP): |
| The Vendor must develop a SSP using the guidance from NIST Risk Management Framework (RMF) (NIST SP 800-18) to establish an information security program in accordance with the Federal Information Security Management Act (FISMA) and demonstrate compliance. |
This SSP must be approved by an authorizing official within the STATE OF ILLINOIS. The SSP must include, but shall not be limited to, the following:
i. Description of how the system is to be compliant with all the United States Federal and State of Illinois laws regarding the security and privacy of medical data and records and of all protected health information (PHI), including:
a) The Code of Federal Regulations (at 45 CFR 95.621), which provides that State of Illinois agencies are responsible for the security of all automated data processing systems involved in the administration of Department of Health and Human Services’ programs, and which includes the establishment of a security plan that outlines how software and data security will be maintained. This section further requires that State of Illinois agencies conduct a review and evaluation of physical and data security operating procedures and personnel practices on a biennial basis.
b) The security and privacy standards contained in Pub. L. 104–191, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and adopted in 45 CFR Part 164, Subparts C and E, as follows: The security standards require that measures be taken to secure protected heath information that is transmitted or stored in electronic format. The privacy standards apply to protected health information that may be in electronic, oral, and paper form.
c) The requirements in section 1902(a)(7) of the Social Security Act (the Act), as further interpreted in Federal regulations at 42 CFR 431.300 to 307.
ii. Description of measures to secure data and software;
iii. Description of how data is encrypted in transit and in storage;
iv. Description of physical and equipment security measures;
v. Description of personnel security;
vi. Description of software used for security;
vii. Description of the user roles and the access capabilities of each role;
viii. Description of how users are assigned certain roles;
ix. Identification of the staff responsible for controlling the system security;
x. Description of contingency security procedures during a disaster recovery event;
xi. Description of how Vendor works with Office of the Statewide Chief Information Security Officer to conduct annual security review;
xii. Description of how Vendor will ensure password security
xiii. Audit trails for all data access;
xiv. Acknowledgement that Vendor will be responsible for all costs associated with Identify theft, resulting from security breach.
D. Security Risk Assessment. STATE OF ILLINOIS or an independent entity will perform a security control assessment. STATE OF ILLINOIS will provide Vendor a copy of the approved security control assessment. Once Vendor receives the approved assessment, Vendor must then develop a Security Risk Assessment based on the applicable security controls. Guidance on conducting and documenting the Security Risk Assessment can be obtained in NIST SP 800-30.
E. Plan of Action and Milestones (POA&M). After STATE OF ILLINOIS reviews and approves the Security Risk Assessment, Vendor should begin to develop a POA&M. The POA&M should be a living document that is based on the findings and recommendations of the security assessment report. The POA&M should describe the deficiencies in the security controls, address the residual risk, and detail plans for remediation and identify timeline for such remediation.
F. Authorization Approval Package.
(a) After STATE OF ILLINOIS reviews and approves the POA&M, Vendor must prepare a transmittal letter to request approval of the entire authorization package. The authorization package must include at a minimum the following documents:
i. Transmittal Letter
ii. Updated System Security Plan
iii. Security Assessment Plan (include the STATE OF ILLINOIS/independent security assessment)
iv. Security Assessment Report (include the STATE OF ILLINOIS/independent security assessment)
v. Security Risk Assessment
vi. Plan of Action and Milestones
vii. Supporting Documentation including but not limited to design documentation, “As Built” documentation, operational documentation, validation documentation, prior authorization documentation, and other artifacts associated with the implementation and monitoring of the security controls.
(b) The authorizing official will determine the risk to the organizational operation and determine if the system is authorized to proceed. The authorizing official will deliver to Vendor a letter of authorization specifying any limitations or restriction placed on the operation of the system. Additionally, this letter should establish an end date for the security authorization.
(c) If the authorizing official denies the authorization, STATE OF ILLINOIS will continue to work with Vendor until an acceptable level of residual risk for the system is achieved. This work should include the continued remediation listed in the POA&M.
G Life-Cycle Management Vendor shall perform security system reviews and reauthorization of the system at the direction of STATE OF ILLINOIS. Vendor shall be responsible for meeting the following requirements:
(a) Performing continuous monitoring of the security system. Vendor’s continuous monitoring must include periodically selecting a subset of the baseline controls for assessment. Based on assessment of these controls, subsequent remediation actions must be identified and implemented. The ongoing remediation process should include updating key documents such as the SSP, SAR, and POA&M.
(b) Prior to any system or environmental modifications, Vendor must perform a security impact analysis. This must be included as a part of any change management or configuration management process. If the results of the modification indicate changes to the security posture of the system, corrective actions should be initiated and appropriate documents revised and updated. The updating of the documentation and continuous monitoring should provide near real-time risk management.
(c) A monthly Security Status Report must be produced by Vendor for STATE OF ILLINOIS. The Security Status Report should provide essential information regarding the security posture of the system as well as the effectiveness of the controls deployed. Ongoing monitoring activities should be detailed as well as ongoing remediation efforts to address known vulnerabilities. Additional guidance for the monitoring of system security can be obtained in NIST SP 800-137.
Security Appendix S5 – Vulnerability Assessment
· Vendor must obtain approval on behalf of the State of Illinois to perform vulnerability assessments on the cloud-hosting vendor’s website(s).
· Vendor must execute the State of Illinois Vulnerability Scanning Agreement prior to the vulnerability assessment.
(See DoIT Scanning Agreement)
· State of Illinois may, with reasonable notice to Vendor, conduct a security assessment of Vendor’s solution, which may include the following:
· Prior to initial “official” production role out of the application,
· Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application
· Manual verification of scan results with the same credentials
· Manual testing of the application for vulnerabilities
· State of Illinois will not conduct any Denial of Service (DOS) attacks
· State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)
· On a quarterly basis for the for the first year after initial production deployment,
· Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application
· Manual verification of scan results with the same credentials
· Manual testing of the application for vulnerabilities
· State of Illinois will not conduct any DOS attacks
· State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)
· Prior to any enhancements or upgrades being deployed to production after the initial “official” production role out of the application,
· Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application
· Manual verification of scan results with the same credentials
· Manual testing of the application for vulnerabilities
· State of Illinois will not conduct any DOS attacks
· State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)
· Monthly vulnerability scan – no whitelisting, non-credentialed scan (same day every month) DoIT Scanning Agreement DDDDddd image1.jpg
File details come from the government source that posted it. Updated .