ESBD_394762_1739204851518_Att. K - TxDMV Security Requirements.docx

Attachment K TxDMV Solicitation No. 608-25-57034

ATTACHMENT K

INFORMATION SECURITY REQUIREMENTS

The Contractor will: (1) use appropriate legal, organizational, physical, administrative, and technical measures, and security procedures, including, without limitation, ensuring TxDMV Confidential Information and the protected data will be encrypted at rest and in motion, to safeguard and ensure the security of TxDMV Confidential Information and the Protected Data and to protect TxDMV Confidential Information and all Protected Data from unauthorized access, hacking, disclosure, duplication, theft, use, modification and/or loss; (2) comply with all applicable federal and State laws and regulations governing the handling of TxDMV Confidential Information and the Protected Data; (3) process all TxDMV Confidential Information and all Protected Data solely within the contiguous United States and limit access to the TxDMV Confidential Information and Protected Data to employees, Subcontractors, and staff of the Contractor who have passed reasonable security clearance checks; and (4) implement physical security and access controls at any of its facilities (including any data centers) that house TxDMV Confidential Information.

Additionally, the Contractor will comply with rules pertaining to information technology security standards found at 1 Tex. Admin. Code pt. 10, Ch. 202, as may be amended from time to time.

TxDMV will have the right to review the Contractor’s security measures to ensure that any data that is in the Contractor’s possession is secure. For any Contractor or Subcontractor that transmits, processes, or stores TxDMV Confidential Information and/or Protected Data, TxDMV may require the Contractor or Subcontractor to periodically provide evidence of its information security policies, procedures, and controls. The Contractor will cooperate fully by providing such evidence and by making resources, employees, and systems available to TxDMV and TxDMV’s authorized representative(s), if requested by TxDMV. TxDMV also reserves the right to immediately terminate network and system connections not meeting such requirements. For any information security risks of the Contractor identified by TxDMV throughout the Term of this Contract, TxDMV may require an action plan to mitigate or remediate the security risk and Contractor agrees to provide such action plan promptly upon request.

Websites that process, transmit, or store TXDMV Confidential Information or Protected Data shall be accessible through a secure connection (HTTPS-only, with HTTP Strict Transport Security (HSTS)), utilizing Transport Layer Security (TLS) version 1.2 or higher.

If Contractor is providing TxDMV software goods or services and/or data processing goods or services, the Contractor agrees to provide secure configuration guidelines that fully describe all security relevant configuration options and their implications for the overall security of the software. The guideline will include a full description of dependencies on the supporting platform, including operating system, web server, and application server, and how they should be configured for security.

Access to Internal TxDMV Network and Systems

As a condition of gaining remote access to any internal TxDMV network and systems, if applicable, the Contractor must comply with TxDMV’s policies and procedures, more fully detailed in the security and awareness training that every contractor and its employees are required to complete prior to obtaining access to TxDMV networks and systems. TxDMV’s remote access request procedures will require the Contractor to submit TxDMV Applicable Access Request forms for TxDMV’s review and approval. Remote access technologies provided by the Contractor must be approved by TxDMV’s Information Security Officer. TxDMV, in its sole discretion, may deny network or system access to any individual that does not complete the required forms. The Contractor must secure its own connected systems in a manner consistent with TxDMV’s requirements. The off-site downloading, transfer, and/or storage of sensitive and Protected Data is strictly prohibited unless such acts are specifically allowed in the Contract’s scope of work. The Contractor may not use any computing device to access TxDMV’s network or e-mail while outside of the continental United States.

The Contractor will ensure that any Contractor employee or Subcontractor who has access to a State computer system or database will complete a cybersecurity training program certified under Section 2054.519 of the Texas Government Code. Such training is required to occur during the Contract Term. Contractor will provide TxDMV with verification of the completion of the requisite training.

Disclosure of Security Breach and Security Vulnerabilities

The Contractor will provide notice to TxDMV’s Contract Representative and TxDMV’s Information Security Officer as soon as possible following the Contractor’s discovery or reasonable belief that there has been unauthorized use, exposure, access, disclosure, compromise, modification, or loss of sensitive data or TxDMV Confidential Information or any breach, denial of service attack and/or inaccessible data due to ransomware or other type of malware (each such event, a “Security Incident”). Within 24 hours of the discovery or reasonable belief of a Security Incident, the Contractor will provide a written report to TxDMV’s Information Security Officer detailing the circumstances of the incident which includes, at a minimum:

A. Description of the nature of the Security Incident;

B. The type of TxDMV information involved;

C. Who may have obtained the information;

D. What steps Contractor has taken or will take to investigate the Security Incident;

E. What steps Contractor has taken or will take to mitigate any negative effect of the Security Incident; and F. A point of contact for additional information.

G. Each day thereafter or as additional information becomes available and until the investigation is complete, the Contractor will provide TxDMV’s Information Security Officer with a written report regarding the status of the investigation and the following additional information:

1. Who is known or suspected to have gained unauthorized access to TxDMV information;

2. Whether there is any knowledge that TxDMV information has been abused or compromised;

3. What additional steps the Contractor has taken or will take to investigate the Security Incident;

a. What steps the Contractor has taken or will take to mitigate any negative effect of the Security Incident; and

b. What corrective action the Contractor has taken or will take to prevent future similar unauthorized use or disclosure.

Further, the Contractor will notify TxDMV within 12 hours of any new report of any security vulnerability that affects their platforms directly or indirectly, that is published in sources including, but not limited to, the Common Vulnerabilities and Exposures and publications of the U.S. Cybersecurity and Infrastructure Security Agency (each such event, a “Security Vulnerability”).

Furthermore, the Contractor will provide an action plan for final resolution of such Security Incident or Security Vulnerability within one week of the date of such Security Incident or Security Vulnerability and complete remediation of such Security Incident or Security Vulnerability must be completed at the Contractor’s sole expense.

The Contractor will confer with TxDMV’s Chief Information Security Officer regarding the proper course of the investigation and risk mitigation. TxDMV reserves the right to conduct an independent investigation of any Security Incident, and should TxDMV choose to do so, Contractor will cooperate fully by making resources, employees, and systems access available to TxDMV and TxDMV’s authorized representative(s). Subject to review and approval of TxDMV’s Information Security Officer, the Contractor, at its own cost, will provide notice that satisfies the requirements of applicable law to individuals whose personal, confidential, or privileged data were compromised or likely compromised as a result of the Security Incident.

Data Ownership and Return

The Contractor hereby acknowledges and agrees that all data provided by TxDMV, or gathered or generated by the Contractor on behalf of TxDMV in the performance of its duties under the Contract, will be and remain the sole property of TxDMV. The Contractor further acknowledges that all such data is confidential and proprietary to TxDMV.

Upon termination or expiration of the Contract, the Contractor will, at no additional cost to TxDMV, promptly return all TxDMV data, including copies made, in a digital format specified by TxDMV. The Contractor will ensure that the data is returned in a manner that is complete, accurate, and accessible to TxDMV.

The Contractor will not retain any copies of the returned data, unless expressly permitted in writing by TxDMV. The Contractor will certify in writing to TxDMV that all data has been returned and that no copies have been retained.

For the avoidance of doubt, the Contractor's obligations and duties under this Subsection will survive the termination or expiration of the Contract. The Contractor is required to fulfill all responsibilities regarding the handling, return, and confidentiality of TxDMV data as stipulated in the Contract, notwithstanding the conclusion of the contractual relationship.