CSM_RFP_Common_Security_Requirements.docx

CSM RFP Common Security Requirements

RFP Common Security Requirements

CONFIDENTIAL INFORMATION

This document is the property of the City of Santa Monica. It contains information that is proprietary, confidential, or otherwise restricted from disclosure. If you are not an authorized recipient, please return this document to the above-named owner. Dissemination, distribution, copying or use of this document in whole or in part by anyone other than the intended recipient is strictly prohibited without prior written permission of City of Santa Monica.

Contents

Introduction Any system that is used for the storage, processing, or transmission of sensitive data (e.g., credit card data) must be “hardened” or configured in a manner that meets industry-accepted hardening standards for the purposes of complying with the Payment Card Industry Data Security Standards (PCI-DSS), Health Insurance Portability and Accountability Act (HIPAA) requirements and Criminal Justice Information Services (CJIS). A system component is any type of device that stores, processes, or transmits data inside the City of Santa Monica digital ecosystem.

Per the City of Santa Monica information security policy, a secure system must be designed and implemented to protect sensitive data. Server, workstations and other system components play an integral part in the security of this information.

Purpose/Scope The primary purpose of the Common Security Requirements document is to ensure thar prospective vendors the City socialite to provide services using digital technology have at least maintain or able to implement the minimum security controls detailed below.

The standards will especially apply to all system components (hardware or software) used in the card data, medical record and criminal history and analysis environments that store, process or transmit sensitive data and serve as a baseline for other City of Santa Monica environments and/or cloud solutions as a security best practice. This includes employees who administer any system components used to process City of Santa Monica ’s sensitive data, along with any entities working for City of Santa Monica as contractors to provide server and/or system management functions.

These security requirements have been developed to specifically address the security controls required by the PCI-DSS, HIPAA and CJIS regulations.

System Hardening Configuration Standard Ownership and Responsibility It is the responsibility of the custodians to ensure security requirements are disseminated to all relevant City of Santa Monica employees (including vendors, contractors, and business partners). Also, the custodians must ensure systems are configured with the security requirements and comply with application regulations such as PCI-DSS, HIPAA, CJIS. This will be reviewed at least annually to reflect changes to business objectives or the risk environment.

Direct questions or comments about these security requirements should be directed to the custodians of this document as detailed in the table below.

System Component Management The following employees at the City of Santa Monica are authorized to manage the corporate system components:

Security Requirements The following sections detail the system configuration standards for technology systems purchases and/or cloud solutions. These configuration standards apply to all applicable system components. They also address known security vulnerabilities and are consistent with industry-accepted system hardening standards (PCI-DSS 2.2, HIPAA and CJIS).

Information Security Policy

1. Vendor shall maintain an Information Security Policy that addresses information security for all personnel

2. This policy must be reviewed annually and include all aspects of requirements noted below Encryption

3. Encryption or equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks.

4. Ensure that 1.2 Transport Layer Security (TLS) protocol or greater are only enabled

5. Ensure that websites have and maintain a valid certificate

6. Enable software defined security (security automated with APIs and code)

7. Where possible Cloud Service Providers shall utilize REST APIs

8. Vendor shall ensure the use of secure measures when transferring, storing and processing data

Antivirus Protections

9. Install antivirus software on all systems commonly affected by malicious software (particularly personal computers and servers).

10. Ensure that antivirus programs are enabled so that they are capable of detecting, removing, and protecting against all known types of malicious software

11. Ensure that all antivirus mechanisms are maintained as follows:

· Are kept current

· Perform periodic scans

12. Ensure antivirus mechanisms are actively running and cannot be disabled or altered by users, unless specifically authorized by management on a case-by-case basis for a limited time period.

13. Generate audit logs which are retained. Audit trail history is retained and in line with business requirements

Access Controls

14. Provide logical access security measures to restrict access to information resources not deemed to be public

15. Procedures and safeguards exist to restrict physical and logical access to the defined system including, but not limited to, facilities, backup, and other system components such as firewalls, routers, media and servers

16. Procedures and safeguards exist to protect against unauthorized access to systems resources

17. Maintain procedures to protect against unauthorized access to system resources

18. Remove/disable inactive user accounts within 90 days

19. Limit repeated access attempts by locking out the user ID after three failed logon attempts and require an administrator reenables the user ID.

20. If a session has been idle for more than 15 minutes, require the user to re-authenticate to re-activate the terminal or session.

21. Ensure local admin or any admin accounts are onboarded into City Privilege Access Management solution

22. Provide flexible and secure Single Sign-On integration to AD/LDAP

23. User access will be administered based on job description and need-to-know

Password Management

24. Change any vendor-supplied default passwords and remove or disable unnecessary default accounts before installing a system on the City network.

a. This applies to ALL default passwords, including but not limited to those used by operating systems, software that provides security services, application and system accounts, point-of-sale (POS) terminals, payment applications, Simple Network Management Protocol (SNMP) community strings, etc.).

25. Where feasible multifactor authentication must be enabled

26. Passwords/passphrases must meet the following requirements:

· Minimum length of at least ten characters

· Contain both numeric and alphabetic characters

· Change user passwords/passphrases at least once every 90 days.

· Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used.

· Set passwords/passphrases for first-time use and upon reset to a unique value for each user and change immediately after the first use.

· Ensure City issued multifactor authentication is used when remotely accessing network

File Integrity Monitoring

27. Ensure systems are configured to store logs in readable format only

28. Use file-integrity monitoring or change-detection software on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert).

29. Deploy a change-detection mechanism (for example, file-integrity monitoring tools) to alert personnel to unauthorized modification (including changes, additions, and deletions) of critical system files, configuration files, or content files; and configure the software to perform critical file comparisons at least weekly.

b. Note: For change-detection purposes, critical files are usually those that do not regularly change, but the modification of which could indicate a system compromise or risk of compromise. Change-detection mechanisms such as file-integrity monitoring products usually come pre-configured with critical files for the related operating system. Other critical files, such as those for custom applications, must be evaluated and defined by the entity (that is, the merchant or service provider).

Continuous Monitoring

30. System is designed with audit logs enabled to include audit and security logs

31. System can be configured to receive the GPO policy that will allow ingestion of the logs into the City’s Security Information and Event Management (SIEM) managed by the information security team, where feasible

Data Management

32. Provide redundancy and backup solution for cloud service ecosystems

Third-Party Hosted Solutions

33. Cloud service provider shall complete the City Vendor Information Security Assessment (VISA) Form and provide to the City’s Information Security Officer

34. Cloud service provider shall provide the City’s Information Security Officer with their latest independent review and assessment (i.e. SAS SOC Type 2 report)

Third-Party Annual Review

35. Cloud service provider system security is periodically reviewed and compared with defined system security policies and best practices and there is a process to address deficiencies

36. Cloud service provider ensures there are independent reviews and assessments performed at least annually (i.e. SAS SOC Type 2 report)

37. Where applicable the vendor shall annually produce evidence of compliance with PCI-DSS, HIPAA and/or CJIS.

38. Where applicable, vendor shall ensure an assume cost for California Law Enforcement Telecommunications (CLETS) Certification for augmented staff performing work on CLETS systems that reside in Public Safety and/or City Attorney Office

Physical Security

39. Data center utilities services and environment conditions (e.g., water, power, temperature and humidity controls, telecommunications and internet connectivity) are secure, monitored, maintained and tested for continued effectiveness

40. Maintain control of physical access to sensitive areas

Change Management

41. Procedures and safeguards exist to effectively apply required system changes

42. Vendor IT staff shall follow change control processes and procedures for all changes to system components

43. Vendor shall remove development, test and/or custom application accounts, user IDs and passwords before applications become active or are released to customers

44. Vendor IT staff shall review custom code prior to release to production or customers in order to identify any potential coding vulnerability (using either manual or automated processes) to include at least the following:

c. Code changes are reviewed by individuals other than the originating code author, and by individuals knowledgeable about code-review techniques and secure coding practices.

d. Code reviews ensure code is developed according to secure coding guidelines

e. Appropriate corrections are implemented prior to release.

f. Code-review results are reviewed and approved by management prior to release.

45. Vendors shall address common coding vulnerabilities in software-development processes by developing applications based on secure coding practices.

Human Firewall Protections

46. Vendor performs employee background checks

47. Vendors shall maintain User Acceptance Agreement with staff to adhere to data privacy, securely handling of data/system and leverage these assets and data for business purposes only

48. Vendor shall maintain procedures to ensure personnel responsible for the design development, implementation, and operation of systems maintaining sensitive data have the qualifications and resources to fulfill their responsibilities

49. Vendor shall maintain an information security awareness program that include annual training of staff

50. Train developers at least annually in up-to-date secure coding techniques, including how to avoid common coding vulnerabilities

Incident Response Plan

51. Cloud service provider maintains cybersecurity insurance

52. Company maintain and follow procedures to identify, report and act upon system security breaches and other incidents

53. Company maintain measures to prevent or mitigate threats

Knowledge Transfer & System Requirements

54. Vendor shall provide architecture and dataflow diagrams for proposed system(s)

55. Vendor shall provide documentation detailing any necessary firewall modifications needed to access application and/or external systems (i.e. opening of ports to external IP address)

56. Vendor shall provide sufficient documentation and training to City staff for usability and administration where appropriate

Patch & Vulnerability Management

57. Disable the use of unneeded ports that would allow USB port usage.

58. If/ when necessary secure (e.g. non-clear text and authenticated) standardized network protocols are used for the import and export of data to manage the service. Vendor shall provide a document to detail the relevant interoperability and portability standards utilized

59. Ensure that all system components and software are protected from known vulnerabilities by applying/maintaining applicable vendor-supplied security patches.

60. Ensure to maintain latest supported operating systems image1.jpg