ESBD_383956_1733948266313_Attachments 1 - 3.pdf

Office of the Attorney General – Child Support Division Certificate of Destruction for Contractors or Vendors

Attachment #1 OAG-CSD Certificate of Destruction for Contractors or Vendors

OPM V1.0

Revised: 04-24-17

Hard copy and electronic media must be sanitized prior to disposal or release for reuse. The OAG tracks, documents, and verifies media sanitization and disposal actions. The media must be protected and controlled by authorized personnel during transport outside of controlled areas. Approved methods for media sanitization are listed in the NIST Special Publication 800-88 Revision 1, Guidelines for Media Sanitization: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

Contact Name Title Company Name and Address Phone

You may attach an inventory of the media if needed for bulk media disposition or destruction.

Media Type Media Title / Document Name

Hard Copy Electronic Media Description

(Paper, Microfilm, Computer Media, Tapes, etc.)

Dates of Records

Document / Record Tracking Number OAG Item Number Make / Model Serial Number

Item Sanitization

CLEAR Who Completed? Who Verified?

PURGE Phone Phone DESTROY DATE Completed

Sanitization Method and/or Product Used

Final Disposition of Media

Reused Internally Destruction / Disposal Reused Externally Returned to Manufacturer Other:

Comments:

If any OAG Data is retained, indicate the type of storage media, physical locations(s), and any planned destruction date.

Description of OAG Data Retained and Retention Requirements:

Proposed method of destruction for OAG approval:

Type of storage media?

Physical location?

Planned destruction date?

Within five (5) calendar days of destruction or purging, provide the OAG with a signed statement containing the date of clearing, purging or destruction, description of OAG data cleared, purged or destroyed and the method(s) used.

Authorized approval has been received for the destruction of media identified above and has met all OAG Records Retention Schedule requirements including state, federal and/or internal audit requirements and is not pending any open records requests.

Records Destroyed by: Records Destruction Verified by:

Signature Date Signature Date

Be sure to enter name and contact info for who completed the data destruction and who verified data destruction in the fields above.

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

Office of the Attorney General – Child Support Division Certificate of Destruction for Contractors or Vendors

Attachment #1 OAG-CSD Certificate of Destruction for Contractors or Vendors

OPM V1.0

Revised: 04-24-17

INSTRUCTIONS FOR CERTIFICATE OF DESTRUCTION

Hard copy and electronic media must be sanitized prior to disposal or release for reuse. The OAG tracks, documents, and verifies media sanitization and disposal actions. The media must be protected and controlled by authorized personnel during transport outside of controlled areas. Approved methods for media sanitization are listed in the NIST Special Publication 800-88 Revision 1, Guidelines for Media Sanitization: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

IRS Publication 1075 directs us to NIST guidelines for sanitization and disposition of media used for federal tax information (FTI). These guidelines are also required for sensitive or confidential information that may include personally identifiable information (PII) or protected health information (PHI). NIST SP 800-88, Appendix A contains a matrix of media with minimum recommended sanitization techniques for clearing, purging, or destroying various media types. This appendix is to be used with the decision flow chart provided in NIST SP 800-88 Revision 1, Section 4.

There are two primary types of media in common use:

• Hard Copy. Hard copy media is physical representations of information. Paper printouts, printer and facsimile ribbons, drums, and platens are all examples of hard copy media.

• Electronic (or soft copy). Electronic media are the bits and bytes contained in hard drives, random access memory (RAM), read-only memory (ROM), disks, memory devices, phones, mobile computing devices, networking equipment, and many other types listed in NIST SP 800-88 Revision 1, Appendix A.

1. For media being reused within your organization, use the CLEAR procedure for the appropriate type of media. Then validate the media is cleared and document the media status and disposition.

2. For media to be reused outside your organization or if leaving your organization for any reason, use the PURGE procedure for the appropriate type of media. Then validate the media is purged and document the media status and disposition. Note that some PURGE techniques such as degaussing will typically render the media (such as a hard drive) permanently unusable.

3. For media that will not be reused, use the DESTRUCTION procedure for the appropriate type of media. Then validate the media is destroyed and document the media status and disposition.

4. For media that has been damaged (i.e. crashed drive) and can not be reused, use the DESTRUCTION procedure for the appropriate type of media. Then validate the media is destroyed and document the media status and disposition.

5. If immediate purging of all data storage components is not possible, data remaining in any storage component will be protected to prevent unauthorized disclosures. Within twenty (20) business days of contract expiration or termination, provide OAG with a signed statement detailing the nature of OAG data retained type of storage media, physical location, planned destruction date, and the proposed methods of destruction for OAG approval.

6. Send the signed Certificate of Destruction to:

OAG: Child Support Division Information Security Office PO Box 12017 Austin, TX 78711-2017 or send as an email attachment to:

Celerino.Torres@oag.texas.gov

Final Distribution of Certificate

Original to: Celerino Torres, Chief Information Security Officer 832-693-0888

Copy to: 1. Your Company Records Management Liaison - or - Information Security Officer

2. CSD Contract Manager http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf mailto:Celerino.Torres@oag.texas.gov

SECURITY INCIDENT REPORT

For Contractors or Vendors

CONFIDENTIAL when filled out (Section 2059.55 TGC & Section 552.139 TGC) Rev. 04-24-2017 Attachment #2 OAG-CSD Security Incident Report for Contractors or Vendors OPM V1.0 Page 1 of 5

To immediately report an incident please contact:

Celerino Torres Chief Information Security Officer Celerino.torres@oag.texas.gov Office (832) 693-0888

Instructions: Each Contractor or business partner (Contractor) is required to provide timely reporting of security incidents to the Office of the Attorney General, Child Support Division (OAG-CSD) Information Security Officer (ISO). Together, the Contractor and OAG-CSD ISO will assess the significance and criticality of a security incident based on the business impact to affected resources and the current and potential effect of the incident (e.g., loss of access to services, revenue, productivity, reputation;

unauthorized disclosure of confidential or private information; loss of data or network integrity; or propagation to other networks).

Depending on the criticality of the incident, it will not always be feasible to gather all the information prior to reporting to OAG-CSD. In such cases, incident response teams should make an initial report and then continue to report information to the OAG-CSD daily until the incident has been resolved and the OAG- CSD ISO has closed the incident. All security incident reports provided to OAG-CSD will be classified and handled as Confidential per Section 2059.055 Texas Government Code (TGC) and Section 552.139 Texas Government Code.

1. Contact Information Company Name:

Full Name:

Job Title:

Division or office:

Work phone:

Mobile phone:

E-mail address:

Fax number:

Additional contact information: (e.g., subject matter experts; incident response team members) Area of Specialty Name Email Phone #

OPM V1.0 Page 2 of 5

2. Type of Incident (Check all that apply)

Account compromise (e.g., lost password) Denial of service (including distributed) Malicious code (e.g., virus, worm, Trojan) Misuse of systems (e.g., acceptable use) Reconnaissance (e.g., scanning, probing)

Social engineering (e.g., phishing, scams) Technical vulnerability (e.g., 0-day attacks) Theft/loss of equipment/media/document Unauthorized access (e.g., systems, devices) Unknown/Other (Please describe below)

Description of incident:

3. Scope of Incident (Check one) Critical (e.g., affects public safety or Federal/State/Individual confidential or private information) High (e.g., affects Contractor’s entire network or critical business or mission systems) Medium (e.g., affects Contractor’s network infrastructure, servers, or admin accounts) Low (e.g., affects Contractor’s workstations or standard user accounts only) Unknown/Other (Please describe below)

Estimated number of systems affected:

(e.g., workstations, servers, mainframes, applications, switches, routers)

Estimated number of users and/or customers affected:

Third-parties involved or affected:

(e.g., vendors, contractors, partners)

Additional scope information:

4. Impact of Incident (Check all that apply) Loss of access to services Loss of productivity Loss of revenue Loss of reputation

Propagation to other networks Unauthorized disclosure of data/information Unauthorized modification of data/information Unknown/Other (Please describe below)

Estimated total cost incurred:

(e.g., cost to contain incident, restore systems, notify data owners, notify customers, credit monitoring fees, fines)

Additional impact information:

5. Sensitivity of Affected Data/Information (Check all that apply)

OPM V1.0 Page 3 of 5

Confidential/Sensitive/IRS data/info Financial data/info Non-sensitive data/info Publicly available data/info

Personally identifiable information

(PII/PHI)

Intellectual property/copyrighted data/info Critical infrastructure/Key resources Unknown/Other (Please describe below)

Quantity of data/information affected:

(e.g., file sizes, number of records)

Describe the data and/or information that may have been compromised:

6. Users and/or Customers Affected by Incident (Provide as much detail as possible)

Number of affected Users Number of affected Customers

User Name User Job Title System access levels or rights of affected users:

(e.g., regular user, domain administrator, root)

Additional User and/or Customer details:

7. Systems Affected by Incident (Provide as much detail as possible) Attack sources (e.g., IP address, port):

Attack destinations (e.g., IP address, port):

IP addresses of affected systems:

Domain names of affected systems:

Primary functions of affected systems:

(e.g., web server, domain controller)

Operating systems of affected systems:

(e.g., version, service pack, configuration)

Patch level of affected systems:

(e.g., latest patches loaded, hotfixes)

Security software loaded on affect systems:

(e.g., anti-virus, anti-spyware, firewall, versions, date of latest definitions)

Physical location of affected systems:

(e.g., state, city, building, room, desk)

Additional system details:

OPM V1.0 Page 4 of 5

8. Remediation of Incident (Provide as much detail as possible – include dates) Actions taken by Contractor to identify affected resources:

contain & investigate incident:

remediate incident:

verify successful remediation:

(e.g., perform vulnerability scan, code review, system tests)

Actions planned by Contractor to prevent similar incidents:

(provide timeline)

Additional remediation details:

9. Timeline of Incident (Provide as much detail as possible)

a. Date and time when Contractor first detected, discovered, or was notified about the incident:

b. Date and time when the actual incident occurred:

(estimation if exact date and time unknown)

c. Date and time when the incident was contained, or when all affected systems or functions were restored:

(use whichever date and time is later)

d. Elapsed time between the incident and discovery:

(e.g., difference between a. and b. above)

e. Elapsed time between the discovery and restoration:

(e.g., difference between a. and c. above)

OPM V1.0 Page 5 of 5

Detailed incident timeline:

Date Time Event/Action/Comment

10. Miscellaneous / Lessons Learned (Provide any other relevant information)

11. List of Attachments (Include the name and date of each attachment)

Please submit the completed form, attachments and all updates to:

Celerino Torres Celerino.Torres@oag.texas.gov

*PLEASE NOTE:

• All Security Incident Reporting Forms and accompanying documentation must be transmitted to OAG-

CSD in a safe and secure manner.

• Please encrypt all documents prior to transmission.

• Please contact the ISO via phone to coordinate your fax transmission or decryption password.

“Upon discovering a possible improper inspection or disclosure of FTI, including breaches and security incidents, by a federal employee, a state employee, or any other person, the individual making the observation or receiving information must contact the office of the appropriate special agent-in-charge, TIGTA immediately, but no later than 24 hours after identification of a possible issue involving FTI. Call the local TITGA Field Division Office first.” “Concurrent to notifying TIGTA, the agency must notify the Office of Safeguards by email to Safeguards mailbox, safeguardreports@irs.gov.” (IRS publication 1075 §10.1)

If criminal action is suspected (e.g., violations of Chapter 33, Penal Code, Computer Crimes, or Chapter 33A, Penal Code, Telecommunications Crimes) the Contractor is also responsible for contacting the appropriate law enforcement and investigative authorities.

mailto:Celerino.Torres@oag.texas.gov mailto:safeguardreports@irs.gov

Rev. 10/16

Date of Award: Object Code:

State of Texas VID #:

Phone #:

Texas certified HUB

(Yes or No)

Texas VID or federal EIN Do not enter Social Security

Numbers. If you do not know their VID / EIN, leave their VID / EIN field blank.

Total Contract $ Amount from HSP with Subcontractor

Total $ Amount Paid this Reporting Period to Subcontractor

Total Contract $ Amount Paid to Date to Subcontractor

Object Code (Agency Use Only)

-$ -$ -$ TOTALS:

When verifying subcontractors' HUB status, ensure that you use the State of Texas’ Centralized Master Bidders List (CMBL) - Historically Underutilized (HUB)

Reporting (Month) Period: -$ Total Amount Paid this Reporting Period to Contractor:

Directory Search located at: HUB status code “A” signifies that the company is a Texas certified HUB.

Contracting Agency/University Name:

Subcontractor’s Name

Report HUB and Non-HUB subcontractor information

This form must be completed and submitted to the contracting agency each month to document compliance with your HSP.

Contractor (Company) Name:

Point of Contact:

Contract/Requisition Number:

HUB Subcontracting Plan (HSP)

Signature: _____________________________________________ Title: _____________________________ Date: _____________________

Prime Contractor Progress Assessment Report http://mycpa.cpa.state.tx.us/tpasscmblsearch/index.jsp.

SAMPLE