ENTERPRISE TECHNOLOGY

PROCUREMENT SECURITY

STANDARD

Version 1.0

Effective July 1, 2026

Lynda Frakes Lynda.Frakes@cvcog.org

Abstract Cybersecurity, Privacy, Artificial Intelligence, Cloud Computing, and Technology Requirements

CVCOG Enterprise Technology Procurement Security Standard Page 1 of 63 Version 1.0

Contents CVCOG Technology Security, Privacy, Artificial Intelligence, and Cloud Requirements

1. Purpose and Scope

2. Definitions

3. Governance and Compliance

4. Cybersecurity Program Requirements

5. Secure Software Development Lifecycle (SSDLC)

6. Identity and Access Management (IAM)

7. Encryption

8. Cloud Security

9. Network Connectivity and Communications

10. Device Security

11. Application Programming Interface (API) Security

12. Integration Requirements

13. Data Ownership, Privacy, and Data Governance

14. Logging and Security Monitoring

15. Vulnerability Management

16. Software and Firmware Updates

17. Backup and Recovery

18. Business Continuity and Disaster Recovery

19. Incident Response and Security Incident Notification

20. Independent Security Assessments

21. Audit Rights and Compliance Verification

22. Cyber Liability and Technology Professional Liability Insurance

23. Warranty, Maintenance, and Support

24. Third-Party and Supply Chain Security

25. Change Management

26. Acceptance Testing

CVCOG Enterprise Technology Procurement Security Standard Page 2 of 63

27. Contract Expiration, Termination, and Transition Assistance

28. Data Management and Reporting Requirements

29. Preferred Security Practices and Evaluation Considerations

30. General Provisions

31. Revision History………………………………………………………………………………………63

CVCOG Enterprise Technology Procurement Security Standard Page 3 of 63

CVCOG Technology Security, Privacy, Artificial Intelligence, and Cloud Requirements

1. Purpose and Scope This appendix establishes the minimum cybersecurity, privacy, information security, operational resilience, artificial intelligence (AI), cloud computing, and information technology requirements applicable to technology procurements conducted by the Concho Valley Council of Governments (CVCOG), hereinafter referred to as the **Agency**.

These requirements apply to all procurements involving software, software-as-a-service (SaaS), cloud services, hosted applications, artificial intelligence and machine learning solutions, managed services, mobile applications, application programming interfaces (APIs), Internet of Things (IoT) devices, edge computing devices, embedded systems, technology hardware, firmware, and related professional services unless expressly waived in writing by the Agency.

The requirements contained herein establish the Agency's minimum acceptable standards and shall be incorporated into Requests for Proposals (RFPs), Requests for Qualifications (RFQs), Invitations for Bids (IFBs), Statements of Work (SOWs), contracts, purchase agreements, amendments, renewals, and other technology procurements, as applicable.

Nothing contained herein shall be construed to relieve the Contractor of its obligation to comply with all applicable federal, state, and local laws, regulations, grant requirements, industry standards, or Agency policies. Where a conflict exists between these requirements and applicable law, regulation, or grant requirements, the more stringent requirement shall apply unless otherwise prohibited by law.

2. Definitions Unless otherwise defined herein, technical terms shall have the meanings commonly accepted within the information technology and cybersecurity professions, including definitions published by the National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA), as applicable.

For purposes of this Appendix, the following definitions apply:

CVCOG Enterprise Technology Procurement Security Standard Page 4 of 63

Agency – The Concho Valley Council of Governments (CVCOG), including any department, program, office, or authorized representative acting on its behalf.

Agency Data – All information created, collected, received, maintained, transmitted, processed, stored, or otherwise managed by or on behalf of the Agency, regardless of format, medium, or storage location.

Agency Information Systems – The Agency's networks, computers, cloud services, mobile devices, applications, databases, infrastructure, operational technology, and other information technology resources.

Artificial Intelligence (AI) – A machine-based system capable of making predictions, recommendations, decisions, classifications, or generating content that influences real or virtual environments.

Cloud Service – Any Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), hosted application, managed cloud service, or other Internet-accessible computing service.

Confidential Information – Any information designated as confidential by law, regulation, contract, grant requirement, or Agency policy, including Agency Data that is not intended for public disclosure.

Contractor – The successful proposer, vendor, supplier, consultant, subcontractor, service provider, or other entity providing goods or services under the Agreement.

Critical Vulnerability – A vulnerability with a Common Vulnerability Scoring System (CVSS) Base Score of **9.0–10.0**, or any vulnerability identified as actively exploited or requiring immediate remediation by the Agency or applicable cybersecurity authorities.

High Vulnerability – A vulnerability with a CVSS Base Score of **7.0–8.9**.

Medium Vulnerability – A vulnerability with a CVSS Base Score of **4.0–6.9**.

Low Vulnerability – A vulnerability with a CVSS Base Score of **0.1–3.9**.

Incident – Any event that disrupts or has the potential to disrupt the confidentiality, integrity, availability, or operation of the Solution.

Major AI Model Change – Any change to an artificial intelligence model, algorithm, supporting software, training methodology, or configuration that could reasonably be expected to materially affect system functionality, outputs, accuracy, security, privacy, interoperability, or decision-making.

CVCOG Enterprise Technology Procurement Security Standard Page 5 of 63

Multi-Factor Authentication (MFA) – Authentication requiring two or more independent authentication factors to verify a user's identity.

Personally Identifiable Information (PII) – Information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information, as defined by applicable federal or state law.

Protected Information – Any information protected by applicable federal or Texas law, regulation, contract, grant requirement, or Agency policy, including, as applicable, Personally Identifiable Information (PII), Protected Health Information (PHI), Criminal Justice Information (CJI), Federal Tax Information (FTI), Controlled Unclassified Information (CUI), confidential business information, and other Agency-sensitive information.

Security Incident – Any actual or suspected event involving unauthorized access, disclosure, modification, destruction, ransomware, malware, denial-of-service attacks, credential compromise, supply chain compromise, or other event that threatens the confidentiality, integrity, or availability of Agency Data or Agency information systems.

Solution – The hardware, software, firmware, cloud services, artificial intelligence components, mobile applications, application programming interfaces (APIs), documentation, professional services, and other technology provided by the Contractor under the Agreement.

Software Bill of Materials (SBOM) – A formal record identifying the software components, libraries, dependencies, versions, and related information comprising the Solution.

Zero-Day Vulnerability – A previously unknown vulnerability for which no official security patch or vendor-approved mitigation was available at the time of discovery.

3. Governance and Compliance The Contractor shall establish, maintain, and document governance processes necessary to ensure continuous compliance with the requirements of this Appendix and all applicable federal, state, and local laws, regulations, grant requirements, contractual obligations, industry standards, and Agency policies throughout the term of the Agreement.

The Contractor shall ensure that all subcontractors, cloud service providers, third-party service providers, and other entities performing work on behalf of the Contractor or processing Agency Data comply with the applicable requirements of this Appendix.

At a minimum, the Contractor shall:

CVCOG Enterprise Technology Procurement Security Standard Page 6 of 63

3.1 Compliance

3.1.1. Comply with all applicable federal, state, and local laws, regulations, executive orders, grant requirements, contractual obligations, and Agency policies applicable to the Solution and the services provided under the Agreement.

3.1.2. Comply with all applicable requirements of funding agencies, regulatory authorities, and oversight organizations having jurisdiction over the Solution or services provided under the Agreement, including, where applicable, the Federal Transit Administration (FTA), the Texas Department of Transportation (TxDOT), and other applicable federal, state, or local agencies.

3.1.3. Maintain compliance throughout the term of the Agreement and promptly implement changes necessary to address new or revised laws, regulations, grant requirements, Agency policies, or applicable industry standards.

3.1.4. Notify the Agency within five (5) business days of any actual or suspected non-compliance, regulatory investigation, enforcement action, legal proceeding, or other event that could materially affect the Contractor's ability to satisfy the requirements of this Agreement.

3.2 Governance

3.2.1. Designate an individual responsible for the Contractor's cybersecurity, privacy, and compliance program who shall serve as the primary point of contact for the Agency.

3.2.2. Maintain documented policies, procedures, and governance processes addressing cybersecurity, privacy, risk management, secure software development, vulnerability management, incident response, business continuity, disaster recovery, change management, and configuration management.

3.2.3. Review and update governance documentation periodically and whenever material changes occur to ensure continued compliance with applicable requirements and industry best practices.

CVCOG Enterprise Technology Procurement Security Standard Page 7 of 63

3.3 Records Management

3.3.1 Support the Agency's obligations under applicable federal and Texas records management requirements, including the Texas Public Information Act, the Texas Local Government Records Act, grant requirements, Agency records retention schedules, litigation holds, and legal discovery obligations.

3.3.2 Preserve Agency records subject to litigation holds, audits, investigations, grant reviews, or public information requests until released in writing by the Agency.

3.3.3 Produce Agency-owned records in a timely manner upon request and in accordance with applicable law, this Agreement, and Agency requirements.

3.4 Accessibility

3.4.1 Ensure all user-facing websites, web applications, mobile applications, portals, dashboards, reports, and other electronic information resources provided under the Agreement comply with applicable accessibility requirements, including Section 508 of the Rehabilitation Act and the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, or any successor standard required by applicable law.

3.5 Continuous Compliance

3.5.1. Cooperate with Agency audits, grant monitoring activities, compliance reviews, inspections, assessments, and other oversight activities related to the Solution or services provided under the Agreement.

3.5.2. Promptly remediate identified compliance deficiencies and provide the Agency with a written corrective action plan, including remediation timelines and periodic status updates until all deficiencies have been resolved.

3.5.3. Failure to maintain compliance with the requirements of this Appendix may constitute a material breach of the Agreement.

CVCOG Enterprise Technology Procurement Security Standard Page 8 of 63

4. Cybersecurity Program Requirements The Contractor shall establish, maintain, and continuously improve a documented cybersecurity program appropriate to the size, complexity, and risk associated with the Solution and the services provided under the Agreement. The cybersecurity program shall protect the confidentiality, integrity, and availability of Agency Data and shall be maintained throughout the term of the Agreement.

4.1 Cybersecurity Governance

4.1.1. Maintain a documented cybersecurity program aligned with one or more nationally or internationally recognized cybersecurity frameworks, including, but not limited to:

• National Institute of Standards and Technology (NIST) Cybersecurity Framework

(CSF) 2.0;

• NIST Special Publication 800-53 (Moderate baseline or higher);

• Center for Internet Security (CIS) Critical Security Controls Version 8; or

• International Organization for Standardization (ISO/IEC) 27001.

4.1.2. Provide documentation identifying the cybersecurity framework(s) used and demonstrate how the Contractor maintains compliance with the selected framework(s).

4.1.3. Review and update the cybersecurity program periodically and whenever material changes occur to the Solution, applicable threats, or regulatory requirements.

4.2 Security Policies

4.2.1. Maintain documented information security policies and procedures addressing administrative, technical, and physical safeguards appropriate to the Solution.

4.2.2. Review and update security policies at least annually or following material organizational, operational, or regulatory changes.

4.3 Risk Management

4.3.1. Maintain a documented risk management process to identify, evaluate, prioritize, mitigate, and monitor cybersecurity risks affecting the Solution.

CVCOG Enterprise Technology Procurement Security Standard Page 9 of 63

4.3.1 Periodically assess cybersecurity risks associated with hardware, software, cloud services, third-party services, artificial intelligence components, and supporting infrastructure.

4.3.2 Implement appropriate administrative, technical, and physical safeguards to reduce identified risks to an acceptable level.

4.4 Security Awareness and Training

4.4.1. Ensure personnel with logical or physical access to Agency Data, Agency systems, or the Solution receive cybersecurity and privacy awareness training at least annually.

4.4.2. Ensure personnel with administrative or privileged access receive role-appropriate security training applicable to their assigned responsibilities.

4.4.3. Maintain documentation demonstrating completion of required training and provide such documentation to the Agency upon reasonable request.

4.5 Secure Operations

4.5.1. Maintain documented operational security procedures supporting the secure administration, monitoring, maintenance, and operation of the Solution.

4.5.2. Ensure cybersecurity responsibilities are assigned to qualified personnel possessing appropriate knowledge, skills, and authority.

4.5.3. Continuously monitor the effectiveness of the Contractor's cybersecurity program and implement improvements necessary to address emerging threats, vulnerabilities, technology changes, and regulatory requirements.

4.5.4. The Contractor shall provide documentation demonstrating compliance with the requirements of this section upon request by the Agency.

5. Secure Software Development Lifecycle (SSDLC) The Contractor shall develop, acquire, maintain, and support the Solution using secure software development practices designed to reduce cybersecurity risks throughout the software lifecycle. The Contractor shall maintain documented secure development processes appropriate to the Solution and the services provided under the Agreement.

CVCOG Enterprise Technology Procurement Security Standard Page 10 of 63

5.1 Secure Development Practices

5.1.1. Maintain a documented Secure Software Development Lifecycle (SSDLC) that incorporates security throughout the planning, design, development, testing, deployment, maintenance, and retirement phases of the Solution.

5.1.2. Integrate security requirements into software design, architecture, coding, testing, deployment, and change management activities.

5.1.3. Utilize secure coding practices and industry-recognized development standards to reduce vulnerabilities and software defects.

5.2 Software Integrity

5.2.1 Digitally sign all software, firmware, operating system images, update packages, and installation media provided to the Agency.

5.2.2 Verify the integrity and authenticity of software, firmware, and updates prior to installation.

5.2.3 Protect source code, build environments, cryptographic signing keys, and software repositories from unauthorized access or modification.

5.3 Security Testing

5.3.1 Perform security testing appropriate to the Solution, including secure code review and vulnerability scanning prior to production release.

5.3.2 Remediate identified vulnerabilities in accordance with the Vulnerability

Management requirements of this Appendix.

5.3.3 Validate security controls following significant software changes, major releases, or architecture modifications.

5.4 Software Supply Chain Security

5.4.1 Maintain a current Software Bill of Materials (SBOM) identifying software components, libraries, dependencies, versions, and other software elements comprising the Solution.

5.4.2 Monitor third-party software components and dependencies for known vulnerabilities and promptly remediate identified security risks.

5.4.3 Maintain processes to evaluate and manage cybersecurity risks associated with open-source software, commercial software, third-party libraries, and externally developed components.

CVCOG Enterprise Technology Procurement Security Standard Page 11 of 63

5.4.4 Ensure third-party software incorporated into the Solution is appropriately licensed, maintained, and supported throughout the term of the Agreement.

5.5 Software Maintenance

5.5.1 Maintain documented procedures for securely developing, testing, approving, releasing, and deploying software updates and patches.

5.5.2 Notify the Agency of software defects, vulnerabilities, or security issues that materially affect the Solution and provide recommended mitigation measures until permanent remediation is available.

5.5.3 Maintain documentation of software releases, security updates, and significant software changes affecting the Solution.

5.6 Continuous Improvement

5.6.1 Periodically review and improve secure software development practices to address evolving cybersecurity threats, software supply chain risks, emerging technologies, and industry best practices.

5.6.2 Provide documentation demonstrating compliance with the requirements of this section upon request by the Agency.

6. Identity and Access Management (IAM) The Contractor shall implement and maintain identity and access management controls that ensure only authorized individuals are granted access to the Solution and Agency Data. Access shall be limited to the minimum permissions necessary to perform assigned responsibilities and shall be managed throughout the user lifecycle.

6.1 Identity Management

6.1.1. Require unique user accounts for all individuals accessing the Solution.

6.1.2. Prohibit shared, generic, anonymous, or group user accounts except where technically required and specifically approved in writing by the Agency.

6.1.3. Support integration with enterprise identity providers using industry-standard authentication protocols, including Security Assertion Markup Language (SAML), OpenID Connect (OIDC), Lightweight Directory Access Protocol (LDAP), or equivalent technologies, where applicable.

CVCOG Enterprise Technology Procurement Security Standard Page 12 of 63

6.1.4. Support secure user provisioning, modification, suspension, and deprovisioning throughout the user lifecycle.

6.2 Authentication

6.2.1. Require Multi-Factor Authentication (MFA) for all administrative accounts, remote access, cloud administration portals, support portals, and any other privileged access to the Solution.

6.2.2. Protect authentication credentials against unauthorized disclosure, interception, reuse, and compromise.

6.2.3. Support configurable password policies, including minimum password length, password complexity, account lockout thresholds, password history, and session timeout settings consistent with Agency security policies.

6.2.4. Eliminate default passwords prior to deployment. Any factory-default credentials shall be changed before the Solution is placed into production.

6.3 Authorization

6.3.1. Implement Role-Based Access Control (RBAC) to ensure users are granted only the permissions necessary to perform their assigned duties.

6.3.2. Enforce the Principle of Least Privilege for all users, administrators, service accounts, APIs, and integrated systems.

6.3.3. Support configurable authorization levels that allow the Agency to assign and modify permissions based on business need.

6.4 Privileged Access

6.4.1. Restrict administrative privileges to authorized personnel with a documented business need.

6.4.2. Log all privileged administrative activities in accordance with the Logging and

Security Monitoring requirements of this Appendix.

6.4.3. Require MFA for all privileged administrative access.

6.5 Service Accounts

6.5.1. Use dedicated service accounts only where technically necessary.

6.5.2. Prohibit the use of shared administrative service accounts unless specifically approved by the Agency.

CVCOG Enterprise Technology Procurement Security Standard Page 13 of 63

6.5.3. Protect service account credentials using secure storage mechanisms and rotate credentials periodically in accordance with documented security procedures.

6.6 Access Reviews

6.6.1. Review user accounts, administrative privileges, service accounts, and assigned permissions at least annually or upon request by the Agency.

6.6.2. Promptly disable or revoke access upon notification by the Agency that access is no longer authorized.

6.7 Session Management

6.7.1. Automatically terminate or lock inactive user sessions after a configurable period of inactivity.

6.7.2. Require re-authentication following session expiration or administrative logout.

6.8 Identity Security

6.8.1. Notify the Agency of any unauthorized access, suspected credential compromise, privilege escalation, authentication failure affecting system security, or other identity-related security incident in accordance with the Incident Response requirements of this Appendix.

6.8.2. Maintain documented procedures for protecting authentication credentials, cryptographic secrets, API credentials, authentication tokens, certificates, and other identity-related security information.

6.8.3. Ensure identity and access management controls remain effective following software updates, system upgrades, maintenance activities, and infrastructure changes.

6.8.4. Provide documentation demonstrating compliance with the requirements of this

7. Encryption The Contractor shall implement and maintain industry-standard cryptographic controls to protect the confidentiality, integrity, and availability of Agency Data throughout its lifecycle.

Encryption shall be used to protect Agency Data during transmission, storage, backup, and processing, as applicable.

CVCOG Enterprise Technology Procurement Security Standard Page 14 of 63

7.1 Data in Transit

7.1.1. Encrypt all Agency Data transmitted across public or untrusted networks using

Transport Layer Security (TLS) version 1.2 or higher. TLS version 1.3 is preferred where supported.

7.1.2. Protect all communications involving cloud services, web applications, mobile applications, APIs, remote administration, remote support, VPN connections, cellular communications, wireless networks, and other network communications using industry-standard encryption protocols.

7.1.3. Use only secure cryptographic protocols and ciphers. Deprecated or insecure protocols and algorithms, including SSL, TLS 1.0, TLS 1.1, DES, 3DES, RC4, MD5, and other obsolete cryptographic methods, shall not be used.

7.2 Data at Rest

7.2.1. Encrypt Agency Data stored on servers, cloud platforms, databases, mobile devices, edge devices, removable media, backup media, and other storage locations using Advanced Encryption Standard (AES) with a minimum key length of 256 bits or an equivalent industry-recognized encryption standard.

7.2.2. Ensure backups containing Agency Data are encrypted in accordance with the requirements of this section.

7.2.3. Encrypt removable storage media used to store or transport Agency Data unless otherwise approved in writing by the Agency.

7.3 Cryptographic Key Management

7.3.1. Generate, store, distribute, rotate, revoke, and retire cryptographic keys using documented key management procedures consistent with industry best practices.

7.3.2. Protect encryption keys, certificates, authentication secrets, API keys, and other cryptographic material from unauthorized access, disclosure, modification, or loss.

7.3.3. Separate cryptographic keys from encrypted data whenever practical.

7.4 Certificates and Digital Trust

7.4.1. Utilize certificates issued by trusted Certificate Authorities (CAs) for externally accessible services unless otherwise approved by the Agency.

7.4.2. Monitor certificate expiration dates and renew certificates prior to expiration to prevent service interruptions.

CVCOG Enterprise Technology Procurement Security Standard Page 15 of 63

7.5 Encryption Management

7.5.1. Document all encryption methods, protocols, and standards utilized by the Solution and provide such documentation to the Agency upon request.

7.5.2. Notify the Agency prior to implementing any material changes to encryption methods, cryptographic algorithms, certificate management practices, or key management processes that may affect the security or interoperability of the Solution.

7.5.3. Ensure encryption controls remain effective following software updates, firmware updates, infrastructure changes, and system maintenance.

7.5.4. Provide documentation demonstrating compliance with the requirements of this

8. Cloud Security The Contractor shall implement and maintain appropriate administrative, technical, and physical safeguards to protect all cloud-hosted components of the Solution. Cloud services shall be designed, operated, and maintained to ensure the confidentiality, integrity, availability, and resiliency of Agency Data throughout the term of the Agreement.

If the Solution does not utilize cloud services, the Contractor shall identify the applicable requirements that do not apply and provide supporting documentation upon request.

At a minimum, the Contractor shall:

8.1 Cloud Environment

8.2.1. Identify all cloud services, hosted platforms, infrastructure providers, and third-party hosting providers supporting the Solution.

8.2.2. Identify the physical location(s) where Agency Data is stored, processed, transmitted, and backed up.

8.2.3. Ensure all Agency Data remains within the United States unless otherwise expressly approved in writing by the Agency.

8.2.4. Notify the Agency at least thirty (30) calendar days prior to any material change in hosting provider, hosting region, cloud architecture, or data residency.

CVCOG Enterprise Technology Procurement Security Standard Page 16 of 63

8.2 Cloud Security Controls

8.2.1. Implement security controls appropriate to the sensitivity of Agency Data and the services provided.

8.2.2. Maintain logical separation between Agency Data and data belonging to other customers in multi-tenant cloud environments.

8.2.3. Encrypt Agency Data in accordance with the Encryption requirements of this

Appendix.

8.2.4. Maintain documented procedures for securely provisioning, configuring, monitoring, maintaining, and decommissioning cloud resources.

8.3 Availability and Resilience

8.3.1. Design cloud services to minimize single points of failure and support continued operation during hardware failures, infrastructure failures, or other service disruptions.

8.3.2. Maintain geographically redundant infrastructure, or equivalent resiliency measures appropriate to the Solution, to support disaster recovery and business continuity.

8.3.3. Maintain documented Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO) consistent with the Backup and Business Continuity requirements of this Appendix.

8.4 Cloud Operations

8.4.1. Monitor cloud infrastructure for security events, operational issues, and service disruptions.

8.4.2. Notify the Agency of any material cloud service disruption, security incident, or degradation of service that could reasonably affect the confidentiality, integrity, availability, or performance of the Solution.

8.4.3. Maintain documented procedures for securely removing Agency Data from cloud resources upon expiration or termination of the Agreement.

8.5 Cloud Compliance

8.5.1. Maintain documentation describing the cloud architecture, security controls, hosting environment, backup strategy, disaster recovery capabilities, and operational responsibilities associated with the Solution.

8.5.2. Upon request, provide documentation demonstrating compliance with applicable cloud security standards, certifications, or independent security assessments applicable to the Solution.

CVCOG Enterprise Technology Procurement Security Standard Page 17 of 63

8.5.3. Provide documentation demonstrating compliance with the requirements of this

8.6 Preferred Cloud Security Practices

The following practices are considered preferred by the Agency and may be considered during the evaluation of proposals when applicable to the Solution. These practices are not mandatory unless specifically identified elsewhere in the solicitation.

8.6.1. Cloud-hosted solutions should maintain one or more independent security certifications or assessments applicable to the services provided, including, where appropriate:

8.6.1.1. SOC 2 Type II

8.6.1.2. ISO/IEC 27001

8.6.1.3. FedRAMP Authorized (where applicable)

8.6.1.4. Other independent third-party security assessments acceptable to the

Agency

8.6.2. The Contractor should provide evidence of current security certifications, independent assessments, or equivalent documentation demonstrating the effectiveness of its cybersecurity program.

8.6.3. Preference may be given to Contractors demonstrating mature cybersecurity governance, independently validated security controls, and recognized industry certifications applicable to the proposed Solution.

8.6.4. The absence of a preferred certification shall not, by itself, disqualify a proposal unless specifically identified as a mandatory requirement elsewhere in the solicitation.

9. Network Connectivity and Communications The Contractor shall fully disclose, document, and maintain all network connectivity, communication methods, external dependencies, and third-party services required for the installation, operation, maintenance, support, administration, and monitoring of the Solution. The Solution shall utilize only those network communications necessary to perform its intended functions and shall support the Agency's cybersecurity architecture and operational requirements.

CVCOG Enterprise Technology Procurement Security Standard Page 18 of 63

9.1 Network Architecture

9.2.1. Provide complete network architecture and data flow documentation identifying communications between on-premises systems, cloud services, edge devices, mobile applications, administrative interfaces, APIs, Agency systems, and third-party services.

9.2.2. Provide logical network diagrams illustrating communication paths, trust boundaries, and external connections associated with the Solution.

9.2 Connectivity Requirements

9.2.1. Identify all required network protocols, ports, services, URLs, domain names, IP address ranges (where applicable), communication endpoints, DNS requirements, Network Time Protocol (NTP) requirements, firewall rules, and bandwidth requirements necessary for operation of the Solution.

9.2.2. Identify all communication methods utilized by the Solution, including wired Ethernet, Wi-Fi, cellular, VPN, Bluetooth, GPS, NFC, satellite, USB, serial communications, or other wired or wireless technologies.

9.2.3. Identify all inbound and outbound network communications required by the Solution and document the purpose of each communication.

9.3 External Dependencies

9.3.1. Disclose all third-party services, cloud providers, hosted platforms, subprocessors, content delivery networks, authentication providers, and external systems supporting the Solution.

9.3.2. Identify the purpose of each external dependency and the types of Agency Data transmitted, processed, or stored.

9.4 Network Security

9.4.1 Ensure all outbound network communications are documented, limited to those necessary for operation of the Solution, and protected in accordance with the Encryption requirements of this Appendix.

9.4.2 Disable, remove, or restrict unnecessary network services, communication interfaces, wireless capabilities, and remote access methods not required for normal operation.

9.4.3 The Solution shall not establish undocumented outbound communications, persistent remote access connections, peer-to-peer communications, CVCOG Enterprise Technology Procurement Security Standard Page 19 of 63 undocumented APIs, or other network connectivity without the Agency's prior written approval.

9.4.4 The Solution shall not require unrestricted Internet access, broad firewall exceptions, disabled cybersecurity controls, or exclusion from the Agency's cybersecurity monitoring.

9.5 Compatibility

9.5.1 Ensure the Solution is compatible with the Agency's cybersecurity controls, including network segmentation, firewall policies, endpoint protection where technically supported, vulnerability management, security monitoring, logging, and incident response capabilities.

9.5.2 Where any component of the Solution cannot support Agency cybersecurity controls, the Contractor shall identify the limitation and provide documented compensating security measures acceptable to the Agency.

9.6 Network Changes

9.6.1 Notify the Agency in writing at least thirty (30) calendar days prior to implementing any material changes affecting network architecture, communication methods, cloud endpoints, firewall requirements, authentication methods, third-party services, integrations, bandwidth requirements, or other connectivity requirements, unless an emergency security update requires more immediate action.

9.6.2 Provide updated network architecture diagrams, communication documentation, and technical specifications whenever material changes are made to the Solution.

9.7 Documentation

9.7.1 Provide sufficient technical documentation to enable the Agency to configure firewalls, proxy services, network segmentation, intrusion detection and prevention systems, security monitoring, DNS services, logging, and other cybersecurity controls necessary to securely operate the Solution.

9.7.2 Provide documentation demonstrating compliance with the requirements of this

10. Device Security The Contractor shall implement and maintain administrative, technical, and physical security controls to protect all hardware, firmware, operating systems, edge devices, CVCOG Enterprise Technology Procurement Security Standard Page 20 of 63 mobile devices, embedded systems, Internet of Things (IoT) devices, and other equipment comprising the Solution from unauthorized access, modification, disruption, or compromise.

10.1 Device Hardening

10.2.1. Configure all devices using secure baseline configurations that minimize cybersecurity risk and disable unnecessary services, applications, protocols, communication interfaces, and user accounts.

10.2.2. Remove or disable default accounts, passwords, and unnecessary software prior to deployment.

10.2.3. Ensure operating systems, firmware, drivers, and embedded software remain supported by the manufacturer throughout the term of the Agreement.

10.2 Operating System Security

10.2.1. Maintain operating systems and firmware at currently supported versions throughout the term of the Agreement.

10.2.2. Apply operating system and firmware updates in accordance with the Software and

Firmware Updates requirements of this Appendix.

10.2.3. Implement documented configuration standards to reduce the attack surface of all deployed devices.

10.3 Device Integrity

10.3.1. Utilize Secure Boot, Trusted Boot, cryptographic validation, or equivalent technologies, where supported, to verify the integrity of the operating system and firmware during startup.

10.3.2. Digitally sign firmware and verify firmware integrity prior to installation.

10.3.3. Protect firmware and system configuration settings from unauthorized modification.

CVCOG Enterprise Technology Procurement Security Standard Page 21 of 63

10.4 Physical Security

10.4.1. Protect devices from unauthorized physical access, tampering, theft, or removal through appropriate physical security controls consistent with the intended operating environment.

10.4.2. Where practical, implement tamper detection or tamper-evident mechanisms for unattended or publicly accessible devices.

10.5 Local Storage

10.5.1. Encrypt locally stored Agency Data in accordance with the Encryption requirements of this Appendix.

10.5.2. Limit locally stored Agency Data to the minimum necessary to support normal operation of the Solution.

10.5.3. Securely erase Agency Data from devices prior to disposal, replacement, reassignment, return, or transfer.

10.6 Peripheral Devices

10.6.1. Disable or restrict USB ports, removable media interfaces, wireless interfaces, debugging interfaces, and other peripheral connections not required for normal operation of the Solution.

10.6.2. Document any enabled peripheral interfaces and their intended operational purpose.

10.7 Remote Device Management

10.7.1. Support secure remote administration only in accordance with the Remote Access requirements of this Appendix.

10.7.2. Ensure remote device management activities are authenticated, authorized, encrypted, and logged.

10.7.3. Provide the capability to remotely disable, isolate, or otherwise secure compromised devices, where technically feasible.

10.8 Device Monitoring

10.8.1. Generate security logs for device startup, shutdown, firmware updates, configuration changes, authentication events, and other security-relevant activities consistent with the Logging and Security Monitoring requirements of this Appendix.

CVCOG Enterprise Technology Procurement Security Standard Page 22 of 63

10.8.2. Monitor device health and operational status to identify failures, security events, or conditions that could materially affect the Solution.

10.9 Device Lifecycle Management

10.9.1. Maintain an inventory of all deployed devices in accordance with the Asset

Inventory and Configuration Management requirements of this Appendix.

10.9.2. Notify the Agency at least twelve (12) months prior to the end-of-support or end-of-life of any hardware, firmware, operating system, or embedded software comprising the Solution.

10.9.3. Provide documentation demonstrating compliance with the requirements of this

11. Application Programming Interface (API) Security The Contractor shall implement and maintain secure Application Programming Interfaces (APIs) used for data exchange, system integration, reporting, administration, automation, or other communications involving the Solution. APIs shall be designed, documented, monitored, and secured to protect the confidentiality, integrity, and availability of Agency Data.

11.1 Authentication and Authorization

11.2.1. Require authentication and authorization for all API access using industry-standard mechanisms appropriate to the intended use of the API, including OAuth 2.0, OpenID Connect (OIDC), mutual TLS (mTLS), API keys, signed tokens, or equivalent secure authentication methods.

11.2.2. Implement Role-Based Access Control (RBAC) and the Principle of Least Privilege for all API clients, service accounts, and integrated systems.

11.2.3. Ensure API credentials are unique, securely stored, and protected from unauthorized disclosure or misuse.

11.2 API Communications

11.2.1 Encrypt all API communications in accordance with the Encryption requirements of this Appendix.

CVCOG Enterprise Technology Procurement Security Standard Page 23 of 63

11.2.2 Validate all API requests and responses to prevent unauthorized access, malformed requests, injection attacks, replay attacks, and other common API security threats.

11.2.3 Implement appropriate safeguards against excessive requests, denial-of-service attacks, brute-force attacks, and other abusive or malicious activity.

11.3 API Documentation

11.3.1 Provide current API documentation describing authentication methods, supported versions, endpoints, request and response formats, data schemas, error handling, rate limits, and usage requirements.

11.3.2 Document all externally accessible APIs. Undocumented or unauthorized APIs shall not be enabled or utilized within the Solution.

11.4 API Lifecycle Management

11.4.1 Support API versioning and maintain backward compatibility whenever practical.

11.4.2 Provide at least ninety (90) calendar days' written notice prior to deprecating, retiring, or making material changes to any API version that could affect Agency integrations.

11.4.3 Notify the Agency prior to implementing material changes affecting API authentication methods, authorization methods, functionality, security controls, data structures, or interface compatibility.

11.5 API Monitoring

11.5.1 Generate audit logs for API authentication attempts, successful and unsuccessful access requests, administrative actions, configuration changes, and other security-relevant events in accordance with the Logging and Security Monitoring requirements of this Appendix.

11.5.2 Monitor API activity for unauthorized access, abnormal usage patterns, excessive requests, authentication failures, and other indicators of malicious activity.

11.6 API Credential Management

11.6.1 Support secure creation, rotation, expiration, revocation, and replacement of API credentials, certificates, tokens, and cryptographic keys without unnecessary disruption to Agency operations.

CVCOG Enterprise Technology Procurement Security Standard Page 24 of 63

11.6.2 Prohibit the use of hard-coded credentials, authentication tokens, API keys, or cryptographic keys within deployed software, firmware, scripts, configuration files, or source code.

11.7 Data Portability

11.7.1 Support secure export of Agency-owned data through documented APIs or commercially available, non-proprietary, machine-readable formats in accordance with the Data Management and Reporting Requirements of this Appendix.

11.7.2 Ensure API functionality supports Agency access to its own data throughout the term of the Agreement and during contract transition activities.

11.8 Compliance

11.8.1 Maintain documentation demonstrating compliance with the requirements of this section and provide such documentation to the Agency upon request.

11.8.2 Ensure APIs remain compliant with the requirements of this Appendix following software updates, infrastructure changes, security patches, and major releases.

12. Integration Requirements The Solution shall support secure, standards-based integration with Agency systems, authorized third-party applications, and future technologies without requiring proprietary interfaces, unnecessary custom development, or the relaxation of Agency cybersecurity controls.

12.1 Interoperability

12.2.1. Support secure integration with Agency systems and authorized third-party applications using documented Application Programming Interfaces (APIs), industry-standard protocols, file exchange methods, or other mutually agreed integration mechanisms.

12.2.2. Utilize open, documented, and commercially recognized standards wherever practical to promote interoperability and minimize vendor lock-in. The Contractor shall not require the exclusive use of proprietary software, proprietary hardware, or proprietary communication protocols where commercially reasonable alternatives exist.

CVCOG Enterprise Technology Procurement Security Standard Page 25 of 63

12.2.3. Ensure integrations preserve data integrity, completeness, accuracy, auditability, and appropriate security controls throughout data transmission and processing.

12.2 Integration Documentation

12.2.1. Provide complete technical documentation for all supported integrations, including authentication methods, authorization requirements, communication protocols, supported versions, API specifications, data formats, schemas, configuration requirements, dependencies, and compatibility information.

12.2.2. Maintain current integration documentation and update such documentation whenever material changes are made to interoperability, interfaces, functionality, or security.

12.3 Data Exchange

12.3.1. Support secure import and export of Agency Data using commercially available, non-proprietary, machine-readable formats.

12.3.2. Ensure imported and exported data retains all required metadata, relationships, timestamps, and other information necessary to preserve data integrity and business functionality.

12.3.3. Provide data dictionaries, schema documentation, and field definitions necessary for the Agency to understand, utilize, and migrate Agency Data.

12.4 Integration Security

12.4.1. Ensure all integrations comply with the Identity and Access Management, Encryption, API Security, Logging and Security Monitoring, and Network Connectivity requirements of this Appendix.

12.4.2. Ensure integrations do not require the Agency to disable, weaken, or bypass cybersecurity controls, including network segmentation, firewall policies, endpoint protection where technically supported, security monitoring, vulnerability management, identity and access management controls, or incident response capabilities.

12.5 Compatibility

12.5.1. Maintain backward compatibility with supported interfaces whenever practical.

CVCOG Enterprise Technology Procurement Security Standard Page 26 of 63

12.5.2. When backward compatibility cannot be maintained, provide documentation, migration guidance, testing support, and reasonable transition assistance prior to implementation.

12.5.3. Notify the Agency at least ninety (90) calendar days prior to implementing material changes affecting interfaces, APIs, authentication methods, communication protocols, data structures, or integration compatibility, unless an emergency security update requires more immediate action.

12.6 Third-Party Integrations

12.6.1. Identify all third-party software, cloud services, libraries, middleware, hosted platforms, and external dependencies required to support system integrations.

12.6.2. Cooperate with the Agency and authorized third-party vendors during implementation, testing, troubleshooting, upgrades, maintenance, migration, and transition activities necessary to maintain interoperability.

12.7 Future Integration

12.7.1. Design the Solution to support future integration with Agency systems without requiring replacement of core system components or creating unnecessary vendor dependency.

12.7.2. The Contractor shall not impose technical restrictions that unreasonably limit the Agency's ability to integrate the Solution with current or future Agency systems.

12.8 Compliance

12.8.1. Maintain documentation demonstrating compliance with the requirements of this section and provide such documentation to the Agency upon request.

13. Data Ownership, Privacy, and Data Governance The Agency retains exclusive ownership of all Agency Data. The Contractor shall collect, access, process, transmit, store, retain, disclose, and dispose of Agency Data only as necessary to perform the services required under the Agreement and in accordance with applicable law, this Appendix, and written Agency authorization.

CVCOG Enterprise Technology Procurement Security Standard Page 27 of 63

13.1 Data Ownership

13.2.1. Acknowledge that all Agency Data, including data created, collected, received, processed, stored, transmitted, generated, or derived through operation of the Solution, remains the sole and exclusive property of the Agency.

13.2.2. Acquire no ownership rights, intellectual property rights, licensing rights, or other proprietary interest in Agency Data by virtue of performing services under the Agreement.

13.2.3. Not sell, monetize, mine, share, license, disclose, or otherwise use Agency Data for any purpose other than fulfilling the requirements of the Agreement without the Agency's prior written authorization.

13.2 Data Privacy

13.2.1. Collect, access, use, retain, disclose, and dispose of Agency Data only to the extent necessary to perform contractual obligations.

13.2.2. Protect all Protected Information in accordance with applicable federal and Texas laws, regulations, grant requirements, contractual obligations, and Agency policies.

13.2.3. Restrict access to Agency Data to authorized personnel with a documented business need and in accordance with the Identity and Access Management requirements of this Appendix.

13.3 Artificial Intelligence and Data Usage

13.3.1. Not use Agency Data to train, improve, validate, fine-tune, benchmark, or otherwise develop artificial intelligence, machine learning, analytics, or other commercial products or services without the Agency's prior written authorization.

13.3.2. Clearly identify any AI-generated outputs produced by the Solution when applicable.

13.3.3. Notify the Agency of any material changes affecting the processing, storage, analysis, or use of Agency Data by artificial intelligence components.

13.4 Data Residency

13.4.1. Store, process, and back up Agency Data only within the United States unless otherwise expressly approved in writing by the Agency.

13.4.2. Notify the Agency prior to any proposed change affecting data residency, hosting location, or cloud service provider.

CVCOG Enterprise Technology Procurement Security Standard Page 28 of 63

13.4.3. The Contractor shall not submit Agency Data to publicly accessible artificial intelligence services,…