ESBD_563015_1790361885308_Form 5 - Security and Privacy Inquiry.pdf

RFQ No. 3202600207 Page 1 of 9 Form 5: Security and Privacy Inquiry

Request for Qualifications (RFQ) Form 5 – Security and Privacy Inquiry

3202600207 Vocational Rehabilitation Impartial Hearing Officers

PURPOSE & INSTRUCTIONS

The Texas Workforce Commission (TWC) is committed to protecting sensitive personal, medical, and case-related data. As an Impartial Hearing Officer (IHO), you will receive, store, and process highly confidential information, including Sensitive Personal Information (SPI) and Protected Health Information (PHI) belonging to Vocational Rehabilitation (VR) customers and Business Enterprises of Texas (BET) participants.

This Security and Privacy Inquiry Form is a standardized agency document required for all contractors who handle SPI and other confidential TWC data, including IHOs who will receive confidential medical and case records.

Instructions for Individual Contractors:

Because this is standardized enterprise IT form, the vast majority of the questions may not apply to an IHO. Respondents are encouraged to use "N/A – Individual Contractor" for any questions that do not apply.

When completing this form, please use the following guidance:

• Enterprise/Cloud Architecture (e.g., FedRAMP, IaaS, PaaS, Data Centers, Boundary/Data Flow Diagrams): If you do not use enterprise-level cloud hosting or commercial data centers, simply write "N/A" in these sections. You do not need to create boundary or data flow diagrams.

• Written Policies: You are not expected to have a comprehensive corporate IT manual. If you do not have formal written data policies, you may simply provide a brief written statement explaining how you ensure the privacy and security of confidential client files on your devices.

RFQ No. 3202600207 Page 2 of 9

• What You DO Need to Answer: TWC primarily needs to verify that you practice basic, secure data habits. Please ensure you answer the questions, confirming that:

1. Your work devices (laptops, computers) are password-protected and encrypted (Section B).

2. You use secure, encrypted email or file transfers when communicating confidential data (Section C).

3. You have a method to securely store the files in compliance with required state record retention periods, and a method to securely delete/destroy the files once that retention period expires (Section D).

4. Sign the form (Section G).

SECTION A: RESPONDENT INFORMATION

Respondent Name (Individual or Firm) ___________________________________

Business Structure [ ] Sole Proprietor / [ ] LLC / [ ] PLLC / [ ] Other: __________

Physical/Home Office Address ___________________________________

Email Address

Phone Number

Sole Point of Contact (if different) ___________________________________

RFQ No. 3202600207 Page 3 of 9

SECTION B: DEVICE SECURITY & ENCRYPTION

(MANDATORY FOR ALL RESPONDENTS)

To comply with TWC data protection standards, all devices (laptops, desktop computers, external hard drives, USB flash drives) used to access, store, or process TWC customer records must be secure.

B.1. Are all laptops, desktops, and mobile devices used for your professional services protected by unique user passwords or biometric logins?

[ ] Yes

[ ] No

If No, please explain:

B.2. Is Full Disk Encryption (FDE) enabled on all devices that will store or access TWC case files? (e.g., BitLocker for Windows, FileVault for macOS, or equivalent software)?

[ ] Yes

[ ] No

If No, please explain:

B.3. If you use external storage media (such as USB flash drives or external hard drives) to backup or transport case files, are these media encrypted?

[ ] Yes

[ ] No

[ ] N/A – Do not use external storage media

RFQ No. 3202600207 Page 4 of 9

B.4. Do you run active, automatically-updating antivirus/anti-malware software on all work devices used for IHO services?

[ ] Yes

[ ] No

If No, please explain:

SECTION C: DATA TRANSMISSION & COMMUNICATION

(MANDATORY FOR ALL RESPONDENTS)

Confidential client and case files must be transmitted securely to prevent unauthorized interception.

C.1. Do you have the capability to send and receive secure, encrypted emails?

[ ] Yes

[ ] No

Briefly list the email encryption method/client you intend to use (e.g., Outlook Message Encryption, Virtru, secure web portals):

C.2. If TWC provides access to a secure file transfer portal (e.g., SFTP or secure cloud sharing link) for uploading decisions and receiving case records, do you agree to utilize only that designated portal for file exchanges?

[ ] Yes

If No, please explain:

RFQ No. 3202600207 Page 5 of 9

C.3. Will any TWC-related data or confidential client files be transmitted, accessed, or stored on devices or IT systems located outside of the United States?

[ ] Yes

[ ] No

(Note: Per Section 6.13 of the RFQ, all TWC data must remain within the United States.)

SECTION D: RECORD RETENTION, STORAGE, & DISPOSAL

IHOs must handle physical and digital records securely and dispose of them in accordance with State of Texas record retention rules.

D.1. Storage of Digital Files: How and where will digital TWC case records, hearing recordings, and draft decisions be stored? (Select all that apply)

[ ] Encrypted local hard drive on a password-protected computer

[ ] Secure, password-protected cloud storage (e.g., OneDrive, Google Drive, Dropbox)

[ ] Other:

D.2. Storage of Physical Files: Will you maintain any paper-based copies of confidential client records or notes?

[ ] No, all files will be managed digitally.

[ ] Yes. (If Yes, confirm they will be stored in a locked filing cabinet or

RFQ No. 3202600207 Page 6 of 9 secure office space accessible only to you):

[ ] Yes, physical files will be locked and secured.

D.3. Secure Disposal: Once the contractually required record retention period expires and/or TWC authorizes the destruction of files, what methods will you use to permanently delete or destroy the data?

• Digital Files: [ ] Secure file wiping software / [ ] Permanent digital deletion

• Physical Files: [ ] Cross-cut shredding / [ ] Approved professional shredding service / [ ] N/A (Digital only)

SECTION E: ENTERPRISE, CLOUD, & SYSTEM ARCHITECTURE

(OPTIONAL / "N/A" FOR INDIVIDUAL CONTRACTORS)

Complete this section ONLY if you use dedicated software-as-a-service (SaaS), custom servers, or cloud-hosted applications to manage or store TWC-related hearing data. If you are an individual using basic local computer software (Word, Adobe Acrobat, standard email), check the N/A box below and proceed to Section F.

[ ] N/A – Individual Contractor utilizing standard local devices and basic software only.

E.1. If you host or store data on cloud infrastructure, is the cloud provider TX-RAMP certified, FedRAMP authorized, or SOC 2 compliant?

[ ] Yes

[ ] No

Identify cloud provider (e.g., AWS, Azure, Google Cloud):

E.2. Can you provide a high-level system boundary diagram or data flow diagram illustrating how TWC data enters, resides in, and exits in your system environment?

RFQ No. 3202600207 Page 7 of 9

[ ] Yes (Please attach)

[ ] No

E.3. Do you perform annual vulnerability assessments or penetration testing on your custom application/system environment?

[ ] Yes

SECTION F: SECURITY POLICIES & INCIDENT RESPONSE

All contractors must have a plan to handle data breaches or security incidents, such as lost devices or unauthorized access to files.

F.1. Incident Notification: Do you agree to notify TWC's Chief Information Security Officer (CISO) and the Hearings Coordinator immediately upon (and no later than twelve (12) hours after) discovering any potential data breach, unauthorized access, or loss of a device containing TWC confidential information?

[ ] Yes

[ ] No

F.2. Security Narrative:

• If you are an enterprise vendor: Please attach your formal, corporate IT Security and Incident Response Policy.

• If you are an individual contractor: Please write a brief, 2-to-3 sentence statement below explaining how you personally ensure the privacy and security of confidential client files on your devices (e.g., physical lockups, screen-locks, restricted device access).

RFQ No. 3202600207 Page 8 of 9

RFQ No. 3202600207 Page 9 of 9

SECTION G: CERTIFICATION & SIGNATURE

(MANDATORY FOR ALL RESPONDENTS)

By signing below, I certify that all information provided on this Security and Privacy Inquiry Form is true, accurate, and complete. I acknowledge that maintaining these security standards is a continuous contractual obligation under any resulting contract with the Texas Workforce Commission (TWC).

Respondent Signature ___________________________________________

Printed Name __________________________________________________

Title

Date