ESBD_File_328573_Addendum 2_Attachment 4_Exhibit N - INFORMATION SECURITY ASSESSMENT EXTERNAL ENTITIES.pdf

Exhibit: N Information Security Assessment

Supplemental Guidance for External Entities

Critical Incident Management System (CIMS) Health and Human Services Commission (HHSC)

Request For Offer (RFO)

Request For Offer (RFO)

RFQ No. HHS0013244

Information Security

Assessment Supplemental

Guidance for External Entities

Contents

1 Purpose

2 Scope

3 Definitions

4 Guidance

4.1 Authority to Receive HHS Data

4.2 Complying with HHS Information Security Requirements

4.2.1 Security Assessment Report

4.2.2 Moderate and High Security Control Baseline Additional Requirements

4.2.3 Regulatory or Federal Overlays Additional Requirements

4.2.4 Reporting Non-Compliance with HHS Requirements

4.3 How to Submit Documentation

5 Guidance Documents

5.1 Federal and State Laws

5.1.1 Title 1, Part 10, Texas Administrative Code (TAC), Chapter 202, Rule §202.24

5.1.2 Information Security Controls (IS-Controls)

6 Revision History

1 Purpose

This document supplements Texas Health and Human Services’ (hereafter referred to as HHS) Information Security Controls (IS-Controls), specifically the following requirements as they apply to external entities:

• CA-02 Security Assessments

• CA-06 Security Authorization

• CA-07 Independent Assessment

This document meets state requirements in Title 1, Part 10, Texas Administrative

Code (TAC), Chapter 202, Rule §202.24, in the Agency Information Security

Program. These requirements include protections based on risk for all information and information resources, including resources outsourced to an external entity.

2 Scope

This document affects external entities responsible for complying with the aforementioned HHS information security requirements and HHS employees who are responsible for monitoring external entity compliance.

3 Definitions

Term Definition

External

Entity

Individuals or organizations external to HHS who have an existing or potential contracting relationship that permits the individual or organization to access, create, disclose, receive, transmit, maintain, or store HHS data.

Independent

Assessments

Independent assessments can be obtained from elements within organizations or can be contracted to public or private sector entities outside of organizations.

RFQ No. HHS0013244 https://hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/information-security-controls.pdf https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=1&pt=10&ch=202&rl=24 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=1&pt=10&ch=202&rl=24

Term Definition

Independent

Assessor

Independent assessors or assessment teams are individuals or groups who conduct impartial assessments of organizational information systems. Impartiality implies that assessors are free from any perceived or actual conflicts of interest with regard to the development, operation, or management of the organizational information systems under assessment or to the determination of security control effectiveness. To achieve impartiality, assessors should not: (i) create a mutual or conflicting interest with the organizations where the assessments are being conducted; (ii) assess their own work; (iii) act as management or employees of the organizations they are serving; or (iv) place themselves in positions of advocacy for the organizations acquiring their services.

4 Guidance

4.1 Authority to Receive HHS Data

Before an external entity receives HHS data, the external entity must comply with

HHS information security requirements as documented in the contractual agreement between the external entity and HHS, and must be authorized to receive data in accordance with IS-Controls CA-06, Security Authorization.

To be granted the authority to connect or authority to operate, the external entity must comply with Section 4.2 Complying with HHS Information Security

Requirements.

https://hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/information-security-controls.pdf

4.2 Complying with HHS Information Security Requirements

Table 1: Security Compliance Requirements, is an embodiment of IS-Controls CA-

02, Security Assessments.1 An external entity’s compliance requirements vary depending on the types of HHS data that it accesses, creates, discloses, receives, transmits, maintains, or stores.

Table 1: Security Compliance Requirements

Security

Control

Baseline or

Overlay2

Required

Documents

Frequency Mandated by

IS-Controls

Low or Low

Plus3

Security Assessment

Report

Biennial

(only submit upon request)

CA-02

Moderate

Security Assessment

Report by an

Independent

Assessor

Biennial

CA-02, CA-

02(01)

High

Security Assessment

Report by an

Independent

Assessor

Annual

CA-02, CA-

02(01)

IRS, CMS-

MARS-E, or

CJIS

Security Assessment

Report by an

Independent

Assessor

Annual CA-02, CA-

02(01)

1 However, an external entity’s contractual agreement with HHS may provide more restrictive compliance requirements.

2 Refer to IS-Controls section 2.1 for a full explanation of all security control baselines and overlays.

3 HHS requires external entities who must comply with the “low” or “low plus” security baselines to complete a Security Assessment Report on a biennial basis. However, external entities are not required to submit the required documentation to HHS unless otherwise stipulated in the contractual agreement, or unless requested by HHS. If HHS requests the required documentation, the external entity must submit it within 90 days of the request.

RFQ No. HHS0013244 https://hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/information-security-controls.pdf https://hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/information-security-controls.pdf

4.2.1 Security Assessment Report

The external entity must complete a Security Assessment Report as proof of compliance with HHS information security requirements. In order for HHS to accept the Security Assessment Report, the external entity must do the following:

1. Submit the Security Assessment Report using the HHS template.

2. Attest that the external entity is compliant with all HHS information security controls required per the external entity’s contractual agreement with HHS.

4.2.2 Moderate and High Security Control Baseline Additional

Requirements

An independent assessment must validate that the external entity meets security compliance requirements. “Independent assessment” is defined in the definition section of this document and described in IS-Controls CA-02(01), Independent

Assessors supplemental guidance.

4.2.3 Regulatory or Federal Overlays Additional Requirements

The external entity may receive some data from HHS that originates from another regulatory or federal source that has additional assessment requirements beyond what is mentioned above. The external entity must refer to its contractual agreement with HHS for any added requirements.

4.2.4 Reporting Non-Compliance with HHS Requirements

External entities must submit additional documentation to HHS for each documented instance of non-compliance with HHS information security requirements.

External entities must submit one of the following applicable forms for each instance of non-compliance to document how they will address the reported non-compliance.

RFQ No. HHS0013244 https://hhs.texas.gov/sites/default/files/documents/laws-regulations/forms/0020/security-assessment-report.docx https://hhs.texas.gov/sites/default/files/documents/laws-regulations/forms/0020/security-assessment-report.docx https://hhs.texas.gov/doing-business-hhs/contracting-hhs

4.2.4.1 Plan of Action and Milestone (POA&M) Form

The external entity must complete a separate Plan of Action and Milestone (POA&M)

Form for each non-compliant information security control that will be remediated.

The external entity must use this form to explain how and when they will become compliant and should include timelines and a remediation plan.

4.2.4.2 Risk Exception Request Form

If the external entity cannot remediate the risk posed by their non-compliance, the external entity must complete a Risk Exception Request Form for each non-compliant information security control that cannot be remediated. The external entity must use the form to explain why they cannot comply with information security requirements and include alternative solutions to reduce the risk posed by the non-compliance.

4.3 How to Submit Documentation

All information security documentation concerning HHS data is classified as confidential. The external entity must send this documentation in a manner compliant with IS-Controls SC-08, Transmission of Confidential Data, and IS-

Controls SC-28, Protection of Data at Rest. The external entity should contact the

HHS point-of-contact identified in the contractual agreement for further guidance on how to securely submit the documents to HHS.

The external entity must submit a Security Assessment Report, along with any of the following document(s) if applicable:

● POA&M forms

● Risk Exception Request Forms

● Any other required security documentation identified in the contractual agreement

HHS reserves the right to request additional information from the external entity to confirm that the applicable information security requirements are in place.

Failure by the external entity to comply with information security requirements may result in consequences including, but not limited to, liquidated damages, contract termination, regulatory fines, or other remedies.

RFQ No. HHS0013244 https://hhs.texas.gov/laws-regulations/forms/0-999/form-0021-external-entity-information-security-plan-action-milestone https://hhs.texas.gov/laws-regulations/forms/0-999/form-0021-external-entity-information-security-plan-action-milestone https://hhs.texas.gov/laws-regulations/forms/0-999/form-0020-external-entity-information-security-risk-exception-request

5 Guidance Documents

The following documents are associated with this guidance.

5.1 Federal and State Laws

5.1.1 Title 1, Part 10, Texas Administrative Code (TAC), Chapter

202, Rule §202.24

Establishes requirements that each agency shall develop, document, and implement an agency-wide information security program that includes protections, based on risk, for all information and information resources.

Link

5.1.2 Information Security Controls (IS-Controls)

Includes safeguards or countermeasures that, when implemented and enforced, satisfy the information security compliance requirements defined in applicable federal and state laws, executive orders, directives, policies, HHS regulations, and standards.

Link

6 Revision History

Date Change Department Owner

06/17/2019 Revised and replaced

IS-RAMP

Chief Information Security Office

08/31/2015 Issued as IS-RAMP Chief Information Security Office

RFQ No. HHS0013244 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=1&pt=10&ch=202&rl=24 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=1&pt=10&ch=202&rl=24 https://hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/information-security-controls.pdf https://hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/information-security-controls.pdf https://txhhs.sharepoint.com/sites/hhsc/IT/busserv/plpp/ppp/Lists/Department%20Designees/AllItems.aspx https://txhhs.sharepoint.com/sites/hhsc/IT/busserv/plpp/ppp/Lists/Department%20Designees/AllItems.aspx

Exhibit M Information Security Assessment Supplemental Guidance-orig