ESBD_533985_1782940295326_Exhibit J.4 - Office of the Chief Information Security Officer Standard Terms.pdf

696-TL-26-O020 Exhibit J.4

Office of the Chief Information Security Officer Standard Terms

A. The Contractor is responsible for following all federal and state laws as well as the Information Resources Security Program (IRSP), the Department’s security policy based on NIST 800- 53.

B. If applicable, cloud services must be Texas Risk and Authorization Management Program (TX-RAMP) certified. The Department shall determine applicability based on the data classification and impact level of the information resource and in consultation with the Department of Information Resources (DIR). The TX-RAMP Program Manual can be found at https://dir.texas.gov/resource-library-item/texas-risk-and-authorization-management-program-manual-30.

C. All Contractor, including any subcontractors, must complete the Department’s Cybersecurity Training Course if they require access to Department systems or data.

D. All Contractor staff, including any subcontractors, with access to Department systems, data, or proprietary information, must agree to and sign the TDCJ EMPL3 form, Data Use and Non- Disclosure Agreement.

E. All deliverables within this Contract are subject to security vulnerability scanning by the Department’s Office of the Chief Information Security Officer (OCISO). Any vulnerabilities found must be corrected on a schedule based on the criticality of the vulnerability.

F. The Department shall perform security penetration testing of the system or application as the Department deems necessary. Any shortcomings identified through the security penetration testing shall be resolved within 30 Days of the results being submitted in writing to the Contractor.

G. The Contractor shall furnish a recent independent report from a certified contractor for network and program security, noting that no vulnerabilities were found for all components of the system or application.

H. Each version of any mobile application or public-facing website that stores or processes confidential or sensitive information must undergo a security penetration test before going live.

Any shortcomings identified during the testing must be resolved before the version goes live.

I. The Contractor shall notify the Department within 24 hours of any supply chain compromises.

Supply chain compromise means confirmed or suspected unauthorized access or tampering impacting confidentiality, integrity, or availability of Department data or systems.

J. The Contractor shall notify, in writing, the Department OCISO of a security incident, including but not limited to cybersecurity breaches, or suspected cybersecurity breaches, within six hours of discovery. Discovery means the point at which the Contractor has a reasonable basis to conclude that a security incident has occurred.

K. The Contractor shall contain and mitigate a security incident within 30 hours of discovery and shall provide a corrective action plan for full remediation if resolution cannot be completed within the timeframe.

696-TL-26-O020 Exhibit J.4

L. At the request of the Department, the Contractor shall submit the results of any assessments or audits for the purpose of continuously monitoring the Contractor.

M. The Contractor shall provide secure Internet Protocol (lP) communications by authenticating and encrypting each lP packet of a communication session for all components of the system or application.

N. The Contractor shall provide firmware updates, application updates, and security testing for all components of the system or application.

O. The Contractor shall promptly install all relevant security patches and anti-virus updates on the Contractor's network.

P. The Contractor shall ensure all Department data, information, or records shall be encrypted in transit and at rest according to the TDCJ IRSP, and the Department’s security policy based on NIST 800-53.

Q. The Contractor shall dispose of any Department data, documentation, tools, or system components according to the TDCJ IRSP using established and approved techniques and methods based on the level of confidentiality.