ESBD_524136_1780667640465_04. Exhibit J.5 - Office of the Chief Information Security Officer Terms and Conditions.pdf

Solicitation Number: IW247306 Exhibit J.5

Office of the Chief Information Security Officer (OCISO) Terms and Conditions

A. The Contractor is responsible for following all federal and state laws as well as the Information Resources Security Program (IRSP). The Department’s security policy is based on NIST 800-

53. A copy of the relevant sections of the IRSP will be provided to the Contractor upon request.

B. If applicable, cloud services must be Texas Risk and Authorization Management Program (TX- RAMP) Level certified. The Department will determine applicability based on the data classification and impact level of the information resource and in consultation with the Texas Department of Information Resources (DIR). The TX-RAMP Program Manual can be found at https://dir.texas.gov/information-security/texas-risk-and-authorization-management-program-tx-ramp.

C. All Contractor staff, including any subcontractors, must complete the Department’s Cybersecurity Training Course if they require access to Department systems, applications, or data.

D. All contractor/vendor staff, including any subcontractors with access to Department systems, data, or proprietary information, must agree to and sign the TDCJ EMPL3 form, Data Use and Non-Disclosure Agreement.

E. Any system must be hosted on secure servers or in a secure cloud in compliance with industry standards such as ISO 27001, SOC 2, and/or NIST 800-53 for data security and management.

F. All deliverables within this SOW are subject to security vulnerability scanning by the Department’s OCISO or a designated vendor. Any vulnerabilities found must be corrected on a schedule based on the criticality of the vulnerability, which will be determined by Department personnel.

G. The Department shall perform security penetration testing of the system as the Department deems necessary. Any shortcomings identified through the security penetration testing shall be resolved within 30 Days of the results being submitted in writing to the Contractor, or a schedule that is determined by the OCISO or Department personnel.

H. The Contractor shall furnish a recent independent report from a certified contractor for network and program security, noting that no vulnerabilities were found for all components of the system or application.

I. Each version of any mobile application or public-facing website that stores or processes confidential or sensitive information must undergo a security penetration test before going live.

Any shortcomings identified during the testing must be resolved before the version goes live.

J. The Contractor shall notify the Department, in writing, within 24 hours of any supply chain compromises. Supply chain compromise means confirmed or suspected unauthorized access or tampering impacting confidentiality, integrity, or availability of Department data or system.

Solicitation Number: IW247306 Exhibit J.5

K. The Contractor shall notify, in writing, the Department OCISO of a security incident, including but not limited to cybersecurity breaches, or suspected cybersecurity breaches, within six hours of discovery. Discovery means the point at which the Contractor has a reasonable basis to include that a security incident has occurred.

L. The Contractor shall resolve a security incident within 30 hours of discovery and shall provide a corrective action plan for full remediation if resolution cannot be completed within that time frame.

M. At the request of the Department, the Contractor shall submit the results of any assessments or audits for the purpose of continuously monitoring the Contractor.

N. The Contractor shall provide secure Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session for all components of the system or application.

O. The Contractor shall provide firmware updates, application updates, and security testing for all components of the system or application.

P. The Contractor shall promptly install all relevant security patches and anti-virus updates on the Contractor's network.

Q. The Contractor shall ensure all Department data, information, or records shall be encrypted in transit and at rest according to the Department’s Information Resources Security Program (IRSP), and the Department’s security policy based on NIST 800-53.

R. The Contractor shall dispose of any Department data, documentation, tools, or system components using established and approved techniques and methods based on the level of confidentiality.