ESBD_464734_1761241620572_OCISO Terms.pdf

This document is a Terms and Conditions document from the Office of the Chief Information Security Officer (OCISO) for the Texas Department of Criminal Justice (TDCJ). The terms outline comprehensive cybersecurity and information security requirements for contractors and vendors working with TDCJ, including mandatory compliance with federal and state information security laws. Key requirements include completing the TDCJ Cybersecurity Training Course, signing a Data Use and Non-Disclosure Agreement, undergoing security vulnerability scanning for all deliverables, and submitting to security penetration testing for mobile applications and public-facing websites.

The document specifies detailed security protocols such as a 24-hour notification requirement for cybersecurity breaches and supply chain compromises, and mandates that all contractor/vendor staff (including subcontractors) must complete specific certification and training before accessing TDCJ systems. Additionally, the terms include provisions for handling Artificial Intelligence (AI) integration, with requirements for proper review and notification to TDCJ, and stipulate that vendors can be re-evaluated if security concerns arise. The terms are based on Texas Government Code sections 2054.0593 and 2054.5192, and align with the TDCJ Information Resources Security Program (IRSP), which is based on NIST 800-53 standards.