ESBD_533985_1782940295471_Exhibit J.5 - Data Management Office Standard Data Requirements.pdf

696-TL-26-O020 Exhibit J.5

Data Management Office Standard Data Requirements

A. Data Ownership

All data produced, created, obtained, maintained, recorded, retained, uploaded, stored, or archived as a part of the IT System and/or IT Services shall be the property of the Department, unless explicitly specified by the Department.

B. Data Usage

1. All information and databases associated with the IT System and/or IT Services are the property of the Department and shall not be given, sold, or used for any other purpose outside of the IT System and/or IT Services without express written consent from the Department.

2. Department information, data and information resources should only be used for the purposes of this Contract.

3. Third party usage of data is prohibited unless authorized by the TDCJ Executive Director or designee, or the Data Management Office, and the Office of the Chief Information Security Officer.

C. Data Disclosure

1. The Contractor shall not disclose Department data or content or any information about the

Department except as compelled by a court or administrative body or required by any law or regulation.

2. The Contractor shall give notice to the Department, if any disclosure request is received for Department data or content, so the Department may file an objection with the court or administrative body.

3. The Contractor has no authority to respond to public information requests.

D. Data Classification/Record Retention

1. In accordance with Texas Government Code 2054.161, all data produced from or used in this IT System and/or IT Services shall be available for classification as determined appropriate for data security and applicable retention requirements under Texas Government Code 441.185 and 441.187 for each classification.

2. The Contractor shall maintain and dispose of data, information, and records in accordance with the retention requirements specified by the Department and using established and approved techniques and methods based on the level of confidentiality.

E. Data Protection/Data Privacy

1. The Contractor shall ensure the protection and privacy of Department information, data, and information systems by:

a. Implementing security controls based on the classification of the data and that the Department determines are proportionate with the Department’s risk under the contract based on the sensitivity and confidentiality of the data.

b. Complying with the information security requirements and the individual Department information policy requirements maintained in the Information Resources Security Program (IRSP), the Department’s security policy based on NIST 800-53 and the Security Requirements within this Contract.

c. Adhering to standards, privacy requirements and regulations for confidential, sensitive, and regulated data to include,

i. Personal Identifying information (PII) or Sensitive Personal information (SPI) as defined in the Texas Business and Commerce Code 521.002(a)(1) and 521.002(a)(2).

ii. Student education data as defined under the Family Educational Rights and Privacy Act (FERPA) 20 U.S.C. § 1232g; 34 CFR Part 9.

iii. Federal Tax Information (FTI), FICA, tax information per IRS Publication 1075

(IRS-1075).

iv. Payment card information data as defined in the Payment Card Industry Data Security Standard (PCI DSS) v2.0.

v. Public Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA) 45 CFR Parts 164.

vi. CJIS Information as defined under Code of Criminal Procedure, Title 1, Chapter 66, Subchapter A and ensure that all components of and data used or created as a part of the IT System and/or IT Services is compliant with the FBI CJIS Security Policy found at https://www.dps.texas.gov/section/crime-records/cjis-documents.

vii. Biometric identifiers, global positioning system technology, or individual contact tracing defined under Biometric Standards by National Science and Technology Council (NSTC), National Institute of Standards and Technology (NIST) and American National Standards Institute (ANSI) and Texas Government Code, Chapter 560.001, 560.002, 2062.001, 2062.002.

viii. All biometric authentication requirements in NIST SP 800-63-3-Digital Identity Guidelines.

2. If applicable, comply with all applicable federal, state, and local and European privacy laws and practices to include General Data Protection Regulation (GDPR).

3. If applicable, cloud services must be Texas Risk and Authorization Management Program (TX-RAMP) Level certified. The Department shall determine applicability and certification level based on the data classification and impact level of the information resource and in consultation with the Department of Information Resources. TX-RAMP Program Manual can be found at https://dir.texas.gov/resource-library-item/texas-risk-and-authorization-management-program-manual-30.

F. Data Encryption

The Contractor shall ensure all Department data, information or records shall be encrypted in transit and at rest according to the TDCJ IRSP, and the Department’s security policy based on NIST 800-53.

G. Data Quality

The Contractor should incorporate Data Quality Management.

1. To ensure that data is sufficiently reliable and consistent for each use case.

2. To provide both existing and new data and verify that it meets data quality standards.

3. Set up data management processes that block low quality data from entering the system and ensure data meets basic data check rules.

4. Ensure data accuracy and data quality and that it is consistent across the system.

5. Support structured data that represents well in tabular format and unstructured data like documents, images, and videos, and semi-structured data that combines the preceding two types.

6. If the data format is audio or video, the data should be maintained, retained, and accessible at the same audio/video quality as it was recorded.

7. If requested by the Department, provide reports for Data Quality standards to include identifying key information missing, incomplete, and duplicate records and for testing and validation purposes.

H. Availability of Data

1. Data, information, and records should be available from the Contractor within the specified timelines as specified by the Department (real-time, batch, archived etc.).

2. The Department reserves the right to request data, information, or records from the Contractor, at no cost to the Department. The data, information, or records shall be provided to the Department via a secure method.

I. Data Architecture

If requested by the Department, the Contractor should provide:

1. A data architecture design document which describes the Department’s data assets and provides a blueprint for creating and managing data flows, entry points, interfaces, and environment names.

2. A data management plan to include technical details, such as operational databases, data lakes, data warehouse, and servers that are best suited to implement the data management strategy.

3. Data models (conceptual and logical) during the design phase.

J. Data Storage

If this Contract is for Cloud Computing Services, as defined by the Texas Government Code Section 2054.0593(a), the Contractor shall:

1. Disclose the name of the cloud service provider, and the location(s) of the data centers used to store data, information, and records.

2. Not store data, information, or records outside the continental United States without express written consent from the Department.

3. Securely store data using approved encryption and access controls to maintain integrity throughout the data’s lifecycle, and upon disposal, sanitize or destroy data in accordance with the TDCJ Information Resources Security Program (IRSP) and NIST SP 800-88 standards.

K. Disaster Recovery

The Contractor should:

1. Replicate data across mirrored databases to ensure high availability.

2. Ensure there is a scheduled data backup frequency based on its criticality and how often it changes.

3. Plan and test a disaster recovery strategy to ensure data can be quickly restored after a data loss incident.

L. Data Sharing

External information systems are not permitted to the internal network without the appropriate monitoring and/or approval by the appropriate approving authority in accordance with an accompanying Memorandum of Understanding (MOU) and Interconnection Security Agreement (ISA), if appropriate.

M. Data Transition

Upon termination of the contract, the Contractor, if requested by the Department, shall transfer all data, information, and records to the Department, on the agreed upon acceptable secure methods of return, destruction, or disposal and within the time specified by the Department.

N. Artificial Intelligence/Machine Learning

1. The Contractor agrees not to use Artificial Intelligence (AI) in the performance of this contract without prior written consent of the Department.

2. The Contractor shall disclose any Artificial Intelligence (AI) used in any component of the IT System and/or IT Services, in what capacity it is being used, and ensure that Department policies and procedures regarding the use of AI are followed at all times.