ESBD_File_323695_Attachment H Information Security Review Form.pdf
PDF 157 KB Posted
- Attached to
- Perkins Monitoring
- Solicitation number
- 701-23-011
- Issued by
- Travis County, Austin City, Texas
About this file
The document is an Attachment H Information Security Review Form related to a state and local contract opportunity issued by the Texas Education Agency (TEA) to support the monitoring of local educational agencies (LEAs) receiving sub-grantee federal Perkins funds. The form requires respondents to provide detailed information on how they will ensure the security and confidentiality of TEA data, including data encryption, data processing location, access controls, authentication methods, vulnerability management, backup procedures, and cybersecurity training and certifications. The related state and local contract opportunity is for Perkins Monitoring, which involves the selection of sub-grantees for on-site visits and desk reviews, the collection of supporting documentation, and program recommendations to the TEA Career and Technical Education (CTE) team. The contract opportunity covers multiple jurisdictions within Texas, including Travis County and the City of Austin.
The document does not provide any information on pricing terms, set asides, incumbents, funding requirements or sources, or other salient commercial details. The focus is on the security and confidentiality requirements for respondents to this contract opportunity.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ATTACHMENT H
INFORMATION SECURITY REVIEW
Respondents must include this completed form with their response. Providing sufficiently detailed responses and confirmation to the following questions will allow TEA to accurately assess and mitigate risk to TEA data.
Question Number: Question Respondent Response to Question
1. How will the respondent ensure that TEA Confidential Information will be encrypted at rest and in motion?
2.
Will the respondent process all TEA Confidential Information solely within the contiguous United States? If you answered ‘No’ to this question, please explain.
3.
How will the respondent ensure that access to TEA Confidential Information will be limited to employees, and subcontractors who have passed reasonable security clearance checks?
4.
What physical security and access controls does the respondent implement at its facilities (including any data centers) that house TEA Confidential Information?
5.
Which authentication methods are leveraged on systems that will house TEA Confidential Information? (i.e., Multi- Factor Authentication (MFA), Privileged Access Management (PAM), and/or 14-character minimum passphrases)
6.
Is Endpoint Detection and Response (EDR) technology enabled on systems that will store, process, or transmit TEA Confidential Information? If not, please provide explanation of protection of the data on the systems from malware.
7. What is the respondent’s established vulnerability and patch management program?
8.
Describe how backups of data are stored and maintained.
Are the backups stored on a separate network from production?
9. Which Cybersecurity Framework is the respondent’s Cybersecurity program based on?
10.
Is cybersecurity awareness training taken annually by employees and subcontractor employees that will have access to TEA Confidential Information? Is the training certified by Texas Department of Information Resources? If not, please provide details about the cybersecurity awareness training program including cadence and source.
11.
Provide evidence of any third-party cybersecurity certifications such as ISO27001 or SOC2 reports, and any gap year assessments or change of scope documentation.
12.
Provide the executive summary of the most recent Penetration Test or Risk Assessment of the customer facing application(s).
13. What changes will be made in the next 18 months that may impact the security of data stored in this environment?
14. Provide your data sanitization and destruction policy.
https://dir.texas.gov/information-security/certified-training-programs https://dir.texas.gov/information-security/certified-training-programs
File details come from the government source that posted it. Updated .