Exhibit A-6 Security Requirements.pdf

Exhibit A-6

Security Requirements

On award of the Contract, the Contractor must comply with State and Federal statutory and regulatory requirements, and rules; National Institute of Standards and Technology (NIST) publications; Control Objectives for Information and Related Technology (COBIT);

all other industry specific standards; national security best practices and all requirements herein.

The Contractor must perform annual testing of all security control requirements to determine they are working as intended. Annual certification must be provided in writing to the Program Manager (PM) or designee in the form of a SSAE16 or similar audit report, if applicable.

A. Governing Security Standards and Publications

The State of Michigan information is a valuable asset that must be protected from unauthorized disclosure, modification, use, or destruction. Prudent steps must be taken to ensure that its integrity, confidentiality, and availability are not compromised.

The Contractor must collect, process, store, and transfer Department of Treasury personal, confidential or sensitive data in accordance with the contractual agreement, State of Michigan policies and the laws of the State of Michigan and the United States, including but is not limited to the following:

1. The Michigan Identity Theft Protection Act, MCL 445.61 et seq;

2. The Michigan Social Security Number Privacy Act, MCL 445.82 et seq.

3. Family Educational Rights and Privacy Act

4. National Institute of Standards and Technology 800-53 (most current version)

5. State of Michigan: The Contractor must comply with the State of Michigan information technology PSPs

6. Treasury PSPs

B. Security Accreditation Process

The Contractor must develop, document, and implement a security plan that provides detailed security controls implemented within the information system. The system security plan must be documented in the software utilized by the State of Michigan (currently Lockpath). If a security plan does not exist, the Contractor shall provide a description of the security controls planned for implementation. The security plan must be reviewed annually, or when there is a significant change, and revised to address system/organizational changes or problems.

The Contractor must conduct assessments of risks and identify the damage that could result from unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the Department of Treasury. Security controls should be implemented based on the potential risks. The Contractor must ensure that reassessments occur whenever there are significant modifications to the information system and that risk assessments are reviewed annually and updated as necessary.

Each Treasury business owner is responsible for completing a Data Classification Declaration (Form DTMB-3544). Data classification is a process that prioritizes the risk level or resources. Data classification identifies and categorizes the business area’s information and information system based on the data’s sensitivity, criticality, and risk.

C. Data Security

The Contractor has the responsibility to protect the confidentiality, integrity, and availability of Department of Treasury data that is generated, accessed, modified, transmitted, stored, disposed, or used by the system, irrespective of the medium on which the data resides and regardless of format (such as in electronic, and non-electronic format).

The Contractor must ensure compliance with Treasury and State of Michigan PSPs when processing, transmitting or storing confidential or sensitive data on a Treasury-owned application, system or database on Treasury’s behalf.

The use of live FTI and production data, in test environments, should generally be avoided and is not authorized unless specifically approved by Treasury’s Office of Privacy and Security. Requests will be evaluated on an individual basis.

D. System Auditing

The Contractor must (i) create, protect, and retain information system audit log records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity, and (ii) ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.

The Contractor must observe the following guidelines regarding system auditing:

1. Audit record should contain the following:

a. date and time of the event

b. subject identity

c. type of event

d. source of event (how data changed)

e. where the event occurred

f. outcome of the event.

2. System alerts if audit log generation fails

3. System protects audit information from unauthorized access

4. Audit record should be reviewed by individuals with a “need to know” on a regular basis

5. Audit logs must be retained either for five years plus current year or in accordance with the applicable Records Retention and Disposal Schedule, whichever is longer.

E. Incident Reporting

1. The Contractor must immediately notify the Program Manager of any security incidents and/or breaches; see Exhibit A-7, What is an Incident? (brochure).

2. The Contractor must have a documented and implemented Incident Response

Policy and Procedure.

3. In the event a security incident occurs, the Contractor must complete Form 4000*;

see Exhibit A-8, Incident Report, and submit it to the Department of Treasury, Office of Privacy and Security.

Note: *Another form may be substituted for Form 4000 if all pertinent information is included.

4. The Contractor must have an incident response resource identified to assist users in handling and reporting incidents.

5. Personnel is trained, at least annually, in their incident response roles and responsibilities.

F. Physical and Environmental Security

The Contractor must have established physical and environmental security controls to protect systems, the related supporting infrastructure and facilities, against threats associated with their physical environment.

1. The Contractor must have established environmental protection, for magnetic and other media, from fire, temperature, liquids, magnetism, smoke, and dust.

2. The Contractor must control all physical access points to facilities containing information systems (except those areas within the facilities officially designated as publicly accessible), review physical security logs periodically, investigate security violations or suspicious physical access activities, and initiate remedial actions.

3. The Contractor must periodically review the established physical and environmental security controls to ensure that they are working as intended.

G. Disaster Recovery and Business Continuity Plan

The Contractor must have developed, periodically update, and regularly test disaster recovery and business continuity plans designed to ensure the availability of Department of Treasury’s data in the event of an adverse impact to the Contractor’s information systems due to a natural or man-made emergency or disaster event.

H. Security Awareness Training

The Contractor must ensure their staff having access to Treasury information are made aware of the security risks associated with their activities and of applicable laws, policies, and procedures related to security identified in Section A of this document and ensuring that personnel are trained to carry out their assigned information security related duties.

Contracted employees must obtain Department of Treasury-provided security awareness training. (On-line training to be identified by the Program Manager).