ESBD_File_352773_Exhibit M POL-604-07 DCS SaaS PaaS Policy.pdf

SERVICE MANAGEMENT MANUAL

Enterprise Policies

Shared Technology Services - SaaS/PaaS Policy

Policy Document

Doc. No.: POL-604-07

Version: 8.0

Version Date: 8/25/2023

Shared Technology Services - SaaS/PaaS Use Policy

Shared Technology Services - SaaS/PaaS Use Policy| Policy |Version: 8.0 |Version Date: 8/25/2023 2 of 10

Table of Contents

1 Background

1.1 Eligible Customers

2 DCS SaaS/PaaS Policy

2.1 SaaS and PaaS Products Purchased Prior to Policy Effective Date

2.2 STS Purchasing Options and Requirements

2.3 STS Program Exemptions: Blanket SaaS Exemptions

2.4 Technology Requirements

2.5 Security Requirements

2.6 Public Cloud Manager (PCM) Services

3 Third-party SaaS/PaaS Products Request Process

3.1 Terms and Conditions

Shared Technology Services - SaaS/PaaS Use Policy| Policy |Version: 8.0 |Version Date: 8/25/2023 3 of 10

1 Background

This policy covers both Data Center Services (DCS) and Application Services Center (ASC) as defined in 1 Texas Administrative Code (TAC) 215 and will be collectively referred to as Shared Technology Services (STS) throughout solely for the sake of convenience. Although the Application Services Center is a separate statewide technology center from the Data Center Services program, both fall within scope of DIR’s STS program. DCS Center governs the infrastructure component of Software as a Service (SaaS) and the ASC governs SaaS as an application.

Effective September 1, 2020, the Public Cloud Manager (PCM) will offer STS Customers a mechanism to purchase SaaS and Platform as a Service (PaaS) products. This policy document defines the guidelines and criteria for which products can be purchased.

Effective August 1, 2021, Texas Administrative Code 215 was updated to further clarify the products that can be purchased through STS. This policy document outlines those clarifications.

1.1 Eligible Customers

Any Department of Information Resources (DIR) Customer that has signed a DCS Inter-Agency Contract (IAC) or Inter-Local Contract (ILC) and agreed to the Program Terms and Conditions may purchase SaaS or PaaS through the Public Cloud Manager

Shared Technology Services - SaaS/PaaS Use Policy| Policy |Version: 8.0 |Version Date: 8/25/2023 4 of 10

2 DCS SaaS/PaaS Policy

STS Customers may purchase SaaS and PaaS products through the Public Cloud Manager when the following conditions are met.

1. The SaaS/PaaS solution must demonstrate compliance with Texas Cybersecurity Framework (TCF) security requirements as well as any applicable legal, regulatory requirements, or directives, including but not limited to 1 TAC 202, IRS Publication 1075, Health Insurance Portability and Accountability Act (HIPAA), Criminal Justice Information Services (CJIS), and others. Options to demonstrate this compliance include:

a. FedRAMP Authorization

b. StateRAMP Authorization

c. TX-RAMP Certification

d. Current Statement on Standards for Attestation Engagements (SSAE) 18 SOC 2

Type 2 report with no significant unresolved findings as needed to obtain provisional TX-RAMP certification and to be followed up with full TX-RAMP certification.

2. The SaaS/PaaS solution must ensure all components and transmission infrastructure are in the contiguous United States (CONUS).

3. The SaaS/PaaS solution must support Role-Based Access Control (RBAC) with demonstrated capability to segregate access based on Customer and role.

4. The SaaS/PaaS solution must demonstrate ability to generate baseline event auditing to Customer-specific logging systems. The Customer is accountable to ensure this capability to meet Audit and Accountability (AU) security controls.

5. The SaaS/PaaS solution must demonstrate the ability to send log events to a Customer-specific logging system that includes methods to ensure confidentiality and integrity of event reporting. For a SaaS/PaaS solution, the Customer is accountable for processing relevant security event logs received from the SaaS/PaaS provider. The Customer is not required to maintain a Security Information and Event Management (SIEM) system, but it is highly recommended. The event logs must include at a minimum the event types designated in the SaaS/PaaS security event standard. Examples of event types and content include:

a. Log onto system,

b. Log off of system,

c. Change of password,

d. All system administrator commands, while logged on as system administrator,

e. Switching accounts or running privileged actions from another account,

f. Creation or modification of super-user groups,

g. Subset of security administrator commands, while logged on in the security administrator role, Shared Technology Services - SaaS/PaaS Use Policy| Policy |Version: 8.0 |Version Date: 8/25/2023 5 of 10

h. Subset of system administrator commands, while logged on in the user role,

i. Clearing of the audit log file,

j. Startup and shutdown of audit functions,

k. Use of identification and authentication mechanisms,

l. Change of file or user permissions or privileges,

m. Content of events must include event type, time of event, outcome of event, and identity of subjects and objects involved in the event, and

n. Provide event logs in near-real-time (frequency no greater than 15 minutes).

6. All SaaS/PaaS data must be encrypted to standards defined in FIPS 140-3 both in transit and at rest with respect to the solution provided.

7. All communications needed for transactions between the DCS environment, and the SaaS/PaaS service must be described and documented such that configuration of boundary devices can be informed and configured to maintain the principle of least functionality for systems communications protection.

8. The SaaS/PaaS solution must demonstrate ability to follow standard PrivID processes for any Customer service accounts to be managed by the Customer and any DCS service accounts needed to provide DCS services, including Privileged Access Management

(PAM).

9. State agencies purchasing Voice or Call Center SaaS or PaaS services must purchase the connectivity to these services through the TEX-AN contracts. If an Agency is on the Capitol Complex the Agency must utilize the centralized Capitol Complex Telephone System as stated in Texas Government Code 2170.059.

2.1 SaaS and PaaS Products Purchased Prior to Policy Effective Date

At the next renewal cycle for SaaS and PaaS products purchased prior to policy effective date, security compliance will be revisited, and compliance documentation requested, if not already completed.

2.2 STS Purchasing Options and Requirements

All SaaS purchases made through STS must:

• Meet 2157 procurement rules and

• Meet STS security requirements.

All STS Customers may purchase SaaS through DCS.

If the SaaS interfaces with DCS environment, the STS Customer is required to purchase the SaaS product through DCS:

https://csrc.nist.gov/publications/detail/fips/140/3/final

Shared Technology Services - SaaS/PaaS Use Policy| Policy |Version: 8.0 |Version Date: 8/25/2023 6 of 10

• Requirement applies to both mandated and voluntary Customers.

• Both mandated and voluntary Customers are required to seek DCS program exemption to purchase outside DCS in this situation. The most probable reason a Customer may seek an exemption is due to DCS funding constraints. Customers will still be required to adhere to the DCS security policy.

If the SaaS does not interface with DCS environment, the Customer may choose to purchase the SaaS product outside DCS:

• Mandated Customers are required to seek DCS program exemption from DCS infrastructure hosting requirement.

• Voluntary Customers are not required to seek DCS program exemption.

The current version of TAC 215, Subchapter D Rule 215.43 (b), as of April 2022 states:

Any of the services described in 1 Texas Administrative Code §215.43(a)(1) that require an interface or connection with the Data Center Services system environment shall be procured only through this Applications Services Center program, unless an exemption has been requested and approved by the department in accordance with 1 Texas Administrative Code §215.44. Compliance with TAC 215 and any subsequent version is required.

The definition of “interface or connection with DCS system environment” means the SaaS would need some network connection between the SaaS product and any DIR DCS environment, both DCS Private and Public Cloud. SaaS/DCS connectivity options are:

• Public Internet,

• Site to site Virtual Private Network (VPN) connection, and

• Dedicated connection (direct connect).

For connectivity reference architecture, please reference ANC-609-33 RA-PCM Software as a Service DCS Connectivity in the STS Service Management Manual (SMM).

State Agencies must utilize the TEX-AN contracts for their connectivity services.

The term “DCS system environment” refers to DCS private cloud including both servers and mainframe technology and DCS public cloud.

Examples of SaaS products that meet the definition of “interface or connect with:”

• UIpath that uses applications or data in DCS environments to automate processing.

• MuleSoft enterprise service bus.

2.3 STS Program Exemptions: Blanket SaaS Exemptions

https://dirsharedservices.service-now.com/sp?id=managed_docsv1&path=15c70b821bf6a850cdb36316624bcb35 https://dirsharedservices.service-now.com/sp?id=managed_docsv1&path=15c70b821bf6a850cdb36316624bcb35

Shared Technology Services - SaaS/PaaS Use Policy| Policy |Version: 8.0 |Version Date: 8/25/2023 7 of 10

The following products are commonly used SaaS products for which DCS program exemptions are routinely approved.

DIR provides a blanket exemption for a list of commonly used SaaS products that:

1. Do not connect to the DCS environment and

2. Do not have confidential or regulated data, as defined in POL-604-11 DIR STS Regulated Data Classification Policy.

If the SaaS product below would be connected to the DCS environment or if it does contain confidential or regulated data, the blanket exemption does not apply.

Blanket SaaS exemptions fall generally into the following categories.

• Electronic Publications, Database or Library Subscription services

• Graphic design or illustration services

• Social media platforms and services

• Survey cloud computing services

• Scheduling cloud computing services

• Training services

• Services where a vendor will not cooperate with SP onboarding requirements or only accepts credit card payments

SaaS products approved for a blanket exemption can be found here: PCM Approved Services | ServiceNow (service-now.com)

A DCS blanket exemption approval does not constitute an approval of a Cooperative Contract exemption. All SaaS products with a DCS blanket exemption must also meet state procurement rules.

2.4 Technology Requirements

SaaS or PaaS products must meet the National Institute of Standards and Technology (NIST) technology definition.

NIST definition of PaaS:

“The capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.”

https://dirsharedservices.service-now.com/sp?id=managed_docsv1&path=0df4f223dbba53404718b0f0ef9619a3 https://dirsharedservices.service-now.com/sp?id=managed_docsv1&path=0df4f223dbba53404718b0f0ef9619a3 https://dirsharedservices.service-now.com/$pa_dashboard.do?sysparm_dashboard=4df5faafdbbc7c9481d641deaa9619ac&sysparm_tab=9ec4e2e9872301902178a9bd3fbb35d9&sysparm_cancelable=true&sysparm_editable=undefined&sysparm_active_panel=false https://dirsharedservices.service-now.com/$pa_dashboard.do?sysparm_dashboard=4df5faafdbbc7c9481d641deaa9619ac&sysparm_tab=9ec4e2e9872301902178a9bd3fbb35d9&sysparm_cancelable=true&sysparm_editable=undefined&sysparm_active_panel=false

Shared Technology Services - SaaS/PaaS Use Policy| Policy |Version: 8.0 |Version Date: 8/25/2023 8 of 10

NIST definition of SaaS:

“The capability provided to the consumer (business user) to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.”

For more information, see https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf.

2.5 Security Requirements

POL-604-02 DIR Infrastructure Data Security Policy outlines the requirements for data security as it relates to DCS systems. All SaaS products that interface or connect with DCS compute are required to comply with security policy monitoring and controls.

2.6 Public Cloud Manager (PCM) Services

For those products on the DCS Service Catalog, the PCM will provide the following services:

• Solution requests for SaaS and PaaS,

• Enable SaaS and PaaS products, https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf https://dirsharedservices.service-now.com/sp?id=managed_docsv1&path=0df4f223dbba53404718b0f0ef9619a3

Shared Technology Services - SaaS/PaaS Use Policy| Policy |Version: 8.0 |Version Date: 8/25/2023 9 of 10

• Monitor availability and resolve incidents,

• Report and track product usage,

• Process credits for missed service level attainment,

• Provide security solutions and security incident response at levels defined for Cloud Service Provider (CSP) enabled SaaS/PaaS services, and

• Provide standard SaaS/PaaS support as required in SMM procedures.

Shared Technology Services - SaaS/PaaS Use Policy| Policy |Version: 8.0 |Version Date: 8/25/2023 10 of 10

3 Third-party SaaS/PaaS Products Request Process

This section describes the process and requirements for DCS Customers to purchase SaaS or PaaS sold through a third-party PaaS or SaaS vendor.

DCS Customers may submit a request, through the existing DCS request process, specifying the product to be evaluated. The PCM will then validate the product meets DCS program requirements and if so, submit to DIR for approval, prior to purchase. In addition to evaluating compliance with DCS program requirements, DIR will determine whether the product falls within the scope of services set out for the DCS program under Texas Administrative Code, Chapter 215.

The Customer is responsible for reviewing and accepting the product’s terms and conditions and will be required to document approval in the request ticket.

These purchases still require state Agency DCS Customers follow procurement laws and rules, including but not limited to Texas Government Code Section 2157.068. State Agency DCS Customers must follow Information Technology (IT) commodity purchasing processes.

3.1 Terms and Conditions

All products the PCM purchases will be in the DCS Customer’s name and owned by the DCS Customer. Therefore, the DCS Customer is accountable for approving all terms and conditions and ensuring all Customer specific terms and conditions are met.