Cybersecurity_Resources_IT_Supplemental.pdf

Information Technology (IT) Supplemental

IT Supplemental Effective Date: November 2025

This supplemental contains additional requirements under Section 2 of the solicitation.

1.1 Deliverables

1.1.1 Deliverable Submission

Deliverable submission instructions will be provided with each Work Order issued.

1.1.2 Deliverable Acceptance

Deliverable Acceptance Criteria will be identified with each Work Order issued.

1.1.3 Minimum Deliverable Quality

Minimum Deliverable Quality will be identified with each Work Order issued.

1.2 Optional Features or Services, Future Work

Additional resources may be requested in the future for Cybersecurity requirements.

1.3 Contractor-Supplied Hardware, Software, and Materials

Contractor-Supplied Hardware, Software, and Materials will be determined with each Work Order issued.

1.4 Products Requirements

THIS SECTION IS INAPPLICABLE TO THIS RFP.

1.5 Maintenance

1.6 Service Level Agreement (SLA)

1.7 Required Project Policies, Guidelines and Methodologies

The Contractor must comply with all applicable laws, regulations, policies, standards and guidelines affecting Information Technology projects, which may be created or changed periodically. These include, but are not limited to:

Reference Regulations, Policies, Guidelines and Methodologies

A The State of Maryland System Development Life Cycle (SDLC) methodology https://doit.maryland.gov/SDLC/Pages/agile-sdlc.aspx

B The State of Maryland Information Technology Security Policy and Standards at:

https://doit.maryland.gov/policies/ci/Pages/default.aspx

C The State of Maryland Information Technology Non-Visual Standards at:

https://doit.maryland.gov/policies/Pages/nva.asp

D The State of Maryland Information Technology Project Oversight at:

https://doit.maryland.gov/epmo/Pages/ProjectOversight.aspx

E The Contractor shall follow Scaled Agile Framework (SAFe 5.0 -https://www.scaledagileframework.com/ or later version) or Project Management Body of Knowledge (PMBOK) unless otherwise noted in the Work Order

F Hardware and Software hardening procedures by Center for Internet Security

(CIS) guides https://www.cisecurity.org/ or Security Requirements Guides (SRG) http://www.nist.gov

G

Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-3:

https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-

3-standards

H Purchasing and Recycling Electronic Products https://dgs.maryland.gov/Pages/GreenPurchasing/Resources/Electronics.aspx http://doit.maryland.gov/SDLC/Pages/agile-sdlc.aspx https://doit.maryland.gov/policies/ci/Pages/default.aspx https://doit.maryland.gov/policies/Pages/nva.asp http://doit.maryland.gov/epmo/Pages/ProjectOversight.aspx https://www.cisecurity.org/ http://www.nist.gov/ https://csrc.nist.gov/publications/detail/fips/140/3/final https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-standards https://dgs.maryland.gov/Pages/GreenPurchasing/Resources/Electronics.aspx

1.8 Disaster Recovery and Data

Disaster Recovery and Data requirements will be provided with each Work Order issued.

1.9 Security Requirements

The following requirements are applicable to the Contract:

1. Employee Identification

a) Contractor Personnel shall display his or her company ID badge in a visible location at all times while on State/Customer premises. Upon request of authorized State/Customer personnel, each Contractor Personnel shall provide additional photo identification.

b) Contractor Personnel shall cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for State/Customer badge issuance.

c) Contractor shall remove any Contractor Personnel from working on the Contract where the State/Customer determines, in its sole discretion, that Contractor Personnel has not adhered to the Security requirements specified herein.

d) The State/Customer reserves the right to request that the Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the Contract.

2. Security Clearance / Criminal Background Check

The State/Customer reserves the right to refuse any individual Contractor Personnel to work on State/Customer premises, based upon certain specified criminal convictions, as specified by the State.

A. A criminal background check for each Contractor Personnel providing services shall be completed within four (4) months of Contract award.

B. Additional background check requirements will be defined in each Work Order.

3. On-Site Security Requirement(s)

On-Site Security Requirements will be defined in each Work Order.

1.9.1 Information Technology Security

A. Contractors shall comply with and adhere to the State IT Security Policies and Standards.

These policies may be revised from time to time, and the Contractor shall comply with all such revisions. Updated and revised versions of the State IT Security Policy and Standards are available online at: https://doit.maryland.gov/policies/ci/Pages/default.aspx.

https://doit.maryland.gov/policies/ci/Pages/default.aspx

B. Contractors shall not connect to the State LAN/WAN, access non‑public State resources, or process non‑public State data using its own equipment without prior written approval from the State, coordinated through the Contract Monitor.

The Contractor shall:

1) For IT Security Policies and Standards that are not covered by the State IT Security Policies and Standards, the Contract shall Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 1.9.2)

2) Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract;

and

3) Ensure compliance with all applicable federal, State, and local laws, rules and regulations concerning security of Information Systems and Information Technology.

1.9.2 Data Protection and Controls

A. If a Work Order requires Contractor provided hardware, the Contractor shall ensure a secure environment for all State data and any hardware and software (including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract according to a written security policy (“Security Plan”) no less rigorous than that of the State and using best practices that comply with an accepted industry standard, such as the NIST cybersecurity framework.

1) The Security Plan shall detail the steps and processes employed by the Contractor as well as the features and characteristics which will ensure compliance with the security requirements of the Contract. Such Security Plan shall be provided to the State for its review with solicitation response. If awarded a contract, the Security Plan shall be provided on an annual basis or whenever updates are made.

2) The Contractor shall supply a copy of such policy to the State for validation, with any appropriate updates, on an annual basis.

B. If a Work Order requires Contractor provided hardware and software, the Contractor shall implement and maintain the following controls during the Contract Term (the Contractor may augment this list with additional controls):

1) Apply hardware and software hardening procedures as recommended Government or industry best practices (e.g. Center for Internet Security (CIS) guides) to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices.

Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control. These procedures may include, but are not limited to, removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the Contractor’s system configuration files.

2) Ensure that State data is not commingled with non-State data through the proper application of compartmentalization Security Measures.

3) Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise directed, the Contractor is responsible for the encryption of all Sensitive Data.

4) Apply data encryption to all Contractor managed or controlled State data when the data is in transit over untrusted network segments.

5) Utilize encryption algorithms for encrypting data that comply with current Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules.”

6) Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers and information security standards, including the Maryland Department of Information Technology’s Information Security Policies and Standards.

7) Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and remediation, if required. The State shall have the right to inspect the logs and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under the Contract.

8) Ensure system and network environments are separated by properly configured and updated layer seven firewalls.

9) Restrict network connections between trusted and untrusted networks by physically or logically isolating systems from unsolicited and unauthenticated network traffic.

10) By default “deny all” and only allow access by exception.

11) Review, at least annually and after changes, the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

12) Perform regular internal and external vulnerability testing of operating system, applications, and all network devices utilized in this Contract. Such testing is expected to identify outdated software versions; missing software patches; device or software misconfigurations; and to validate compliance with or deviations from the security policies applicable to the Contract. Contractor shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and remediate the vulnerability no later than 30 days following the earlier of vulnerability’s identification or public disclosure, or document why remediation action is unnecessary or unsuitable. The State shall have the right to conduct vulnerability testing and inspect the results of similar Contractor performed vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

13) Enforce strong user authentication and password control measures to minimize the opportunity for unauthorized access through compromise of the user access controls. At a minimum, the implemented measures should be consistent with the most current Maryland Department of Information Technology’s Information Security Policies, including specific requirements for password length, complexity, history, and account lockout.

14) Ensure that anti-virus and anti-malware software is installed and maintained on all systems and end points supporting the services provided under the Contract; that the anti-virus and anti-malware software is automatically updated; and that the software is configured to actively scan and detect threats to the system for remediation. The Contractor shall perform routine weekly vulnerability scans and take corrective actions for any findings.

15) Conduct regular external vulnerability testing designed to examine the service provider’s security profile from the Internet without benefit of access to internal systems and networks behind the external security perimeter. Evaluate all identified vulnerabilities on Internet-facing devices for potential adverse effect on the service’s security and integrity and remediate the vulnerability promptly or document why remediation action is unnecessary or unsuitable. The State shall have the right to inspect the Contractor’s processes and the performance of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract. The State reserves the right to test services from the public internet.

1.9.3 Security Logs and Reports Access

If required at the Work Order level:

A. For any cloud hosted, or Contractor, or third party hosted solution, the Contractor shall provide security logs and reports to the State in a mutually agreeable format.

B. Reports shall include latency statistics, user access, user access IP address, user access history and security logs for all State data, systems, and software data, systems, and software related to the Contract.

1.9.4 Payment Card Industry Compliance

If required at the Work Order level:

A. Contractor shall at all times comply, and ensure compliance with, all applicable Payment Card Industry ("PCI") Data Security Standards (“DSS”), including any and all changes thereto. Contractor shall provide the Contract Monitor with documented evidence of current compliance to PCI DSS within 30 days of request.

B. The Contractor shall annually furnish to the Contract Monitor evidence of the PCI Security Standards Council’s (SSC) acceptance or attestation of the Contractor’s conformance to the relevant PCI DSS requirements by a third party certified to perform compliance assessments.

C. The Contractor shall ensure that the scope of the annual SOC 2 Type II Audit Report specified under Section 1.10 includes testing to confirm the PCI assessment results, if a SOC 2 Type Audit Report is a requirement of an applicable Work Order.

1.9.5 Security Incident Response

A. The Contractor shall notify the State when any Contractor or Contractor system that may access, process, or store State data or State systems experiences a Security Incident or a Data Breach as outlined in State Incident Reporting Policies:

1. https://doit.maryland.gov/policies/ci/Pages/default.aspx

2. https://doit.maryland.gov/policies/ci/Pages/cybersecurity-incident-reporting-requirements-for-state-governments.aspx

3. https://doit.maryland.gov/policies/ci/Pages/cybersecurity-incident-reporting-requirements-for-local-governments.aspx B. Discussing Security Incidents with the State should be handled on an urgent as-needed basis, as part of Contractor communication and mitigation processes as mutually agreed upon, defined by law or contained in the Contract. The Contractor shall obtain approval from the State prior to communicating with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise.

C. The Contractor shall comply with all applicable system security breach laws.

1.9.6 Data Breach Responsibilities

A. If the Contractor reasonably believes or has actual knowledge of a Data Breach, the

Contractor shall, unless otherwise directed:

1) Reports to the Maryland Security Operations Center (MD-SOC) must be made as soon as practicable, but not later than one (1) hour after confirmation of a detected cybersecurity incident. If an organization is unsure whether an event constitutes a reportable cybersecurity incident and is actively investigating the circumstances, it may delay reporting for up to three (3) hours from initial detection while working to conclusively determine whether a reportable cybersecurity incident occurred, for a total of four (4) hours between detection and reporting. If, during the course of its investigation, the organization confirms that a reportable cybersecurity incident occurred, it must immediately report the incident to the MD-SOC;

2) The Contractor should not wait for absolute confirmation that a cybersecurity incident has occurred before reporting because any delay may affect the ability to take preventative and remedial measures to protect information or reduce the risk of harm;

https://doit.maryland.gov/policies/ci/Pages/default.aspx https://doit.maryland.gov/policies/ci/Pages/cybersecurity-incident-reporting-requirements-for-state-governments.aspx https://doit.maryland.gov/policies/ci/Pages/cybersecurity-incident-reporting-requirements-for-state-governments.aspx https://doit.maryland.gov/policies/ci/Pages/cybersecurity-incident-reporting-requirements-for-local-governments.aspx https://doit.maryland.gov/policies/ci/Pages/cybersecurity-incident-reporting-requirements-for-local-governments.aspx

3) The timelines stated above are applicable unless a shorter time is required by applicable law;

4) Cooperate with the State to investigate and resolve the data breach;

5) Promptly implement commercially reasonable remedial measures to remedy the

Data Breach; and

6) Document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services.

B. With respect to State data within the possession or control of the Contractor, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by State law; (3) a credit monitoring service required by State or federal law; (4) a website or a toll-free number and call center for affected individuals required by State law; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause; all [(1) through (5)] subject to the Contract’s limitation of liability.

C. The public disclosure of a cybersecurity incident shall be pursuant to the Guidelines for the Public Disclosure of Cybersecurity Incidents or any successor (https://doit.maryland.gov/policies/ci/Pages/guidelines-for-the-public-disclosure-of-cybersecurity-incidents.aspx).

1.9.7 Additional security requirements may be established in a Work Order.

1.9.8 The State shall, at its discretion, have the right to review and assess the Contractor’s compliance to the security requirements and standards defined in the Contract.

1.9.9 Provisions in Sections 1.9.1 – 1.9.8 shall survive expiration or termination of the Contract.

Additionally, the Contractor shall flow down the provisions of Sections 1.9.1 - 1.9.8 (or the substance thereof) in all subcontracts.

1.10 SOC 2 Type 2 Audit Report

The State may request a SOC 2 Audit Report. These requirements will be defined in each Work Order.

1.11 Nonvisual Access

Nonvisual Access requirements will be defined in each Work Order.

https://doit.maryland.gov/policies/ci/Pages/guidelines-for-the-public-disclosure-of-cybersecurity-incidents.aspx https://doit.maryland.gov/policies/ci/Pages/guidelines-for-the-public-disclosure-of-cybersecurity-incidents.aspx

1.12 Mercury and Products That Contain Mercury

1.13 Location of the Performance of Services Disclosure

The Bidder/Offeror is required to complete and submit with the Bid/ Proposal the Location of the Performance of Services Disclosure. A copy of this Disclosure is included as Attachment K.

1.14 HIPAA - Business Associate Agreement

HIPAA Business Associate Agreement requirements will be defined in each Work Order.

1.15 Additional Clauses

The Contractor is subject to the requirements in this section and shall flow down the provisions of Sections 1.15.1 – 1.15.5 (or the substance thereof) in all subcontracts.

1.15.1 Custom Software

A. As described in the sample contract (Exhibit 2), the State shall solely own any custom software, including, but not limited to application modules developed to integrate with a COTS, source code, maintenance updates, documentation, and configuration files, when developed under the Contract.

B. Upon a Contractor's voluntary or involuntary filing of bankruptcy or any other insolvency proceeding, Contractor’s dissolution, Contractor’s discontinuance of support of any software or system, the Contractor shall convey to the State all rights, title, and interests in all custom software, licenses, software source codes, and all associated System Documentation that comprises any solutions proposed as a part of the Contract These rights include, but are not limited to, the rights to use, and cause others to use on behalf of the State, said software, software documentation, licenses, software source codes, and System Documentation.

1.15.2 Custom Source Code

A. For all custom software provided to the State pursuant to any Contract, the Contractor shall either provide the source code directly to the State in a form acceptable to the State, or deliver two copies of each software source code and software source code documentation to a State-approved escrow agent at no additional cost to the State following the terms set forth in the sample contract (Exhibit 2) and in Section 1.15.2 below.

B. The State shall have the right to audit custom software source code and corresponding software source code documentation for each software product that comprises the solution as represented by the Contractor. The State shall be provided with software or other tools required to view all software source code. See Right to Audit in the State Contract.

C. The Contractor shall provide the current source code and documentation for all custom software to the State at the time of Contract termination.

1.15.3 Source Code Escrow

1.15.4 Purchasing and Recycling Electronic Products

1.15.5 The State of Maryland’s Commitment to Purchasing Environmentally Preferred Products and Services (EPPs)

Maryland’s State Finance & Procurement Article §14-410 defines environmentally preferable purchasing as “the procurement or acquisition of goods and services that have a lesser or reduced effect on human health and the environment when compared with competing goods or services that serve the same purpose.” Accordingly, Bidders/Offerors are strongly encouraged to offer EPPs to fulfill this contract, to the greatest extent practicable.

1.16 Considerations for IT Technical Proposals

Additional considerations for IT Technical Proposals will be defined in each Work Order.

https://trackbill.com/bill/maryland-house-bill-629-environmentally-preferable-procurement-maryland-green-purchasing-committee/647077/