EXHIBIT A - ATTACHMENT 1 - IT Requirements_Data Security Checklist.xlsx
XLSX spreadsheet 53 KB Posted
- Attached to
- RFP - COMMUNITY CARE COORDINATION (C3) STRONG
- Solicitation number
- BPM013083
- Issued by
- California
About this file
This is an Information Technology Requirements and Data Security Checklist document prepared for RFP 13083 issued by the County of San Diego Department of Housing and Community Development Services, Office of Homeless Solutions, for the Community Care Coordination (C3) STRONG program. The document outlines the mandatory technical and security requirements that all proposers must address in their responses, encompassing both business-critical requirements and baseline security standards across multiple control categories including access control, audit and accountability, identification and authentication, system communications protection, and incident response. The requirements address specific technical implementations such as Endpoint Detection & Response software, data encryption standards (both in-transit and at-rest using FIPS 140-3 validated cryptographic modules), audit logging capabilities, and integration with the County's external identity provider. The document also specifies that all support must be provided from within the United States, with all data processing and storage remaining within U.S. borders.
The checklist includes multiple compliance frameworks and standards that the proposed solution must meet, including HIPAA, Fair Labor Standards Act, OSHA, Privacy Act, and SOC 2 Type 2 audit requirements, with specific provisions for sensitive personally identifiable information and electronic protected health information. Contractors are required to provide annual SOC 2 Type 2 reports prepared by third-party auditors, maintain incident response plans, conduct annual penetration testing, and implement weekly vulnerability scanning. Additional project requirements encompass system documentation, online help functionality, training materials, and data extraction and conversion services from existing systems. The document does not include pricing information, set-asides, incumbency details, or specific funding amounts, as these elements are contained in separate RFP sections not included in this attachment.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| ATTACHMENT A_HHSA_linguistic_and_cultural_diversity_plan.docx | DOCX document | |
| ATTACHMENT B_EXHIBIT C_BUDGET COST REIMBURSEMENT.xlsx | XLSX spreadsheet | |
| RFP 13083 C3 STRONG PACKET.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Version Log
| Version | Date | Description |
| 1 | 7/5/18 | Initial draft |
| 2 | 7/13/18 | Updates from team review; remove Pricing and Customer References tabs. |
| 2.1 | 7/15/18 | Minor editing: instructions, vendor profile, and questionnaire worksheets |
IT Requirements - Attach. 1 Request for Proposal (RFP) 13083
DEPARTMENT OF HOUSING AND COMMUNITY DEVELOPMENT SERVICES
OFFICE OF HOMELESS SOLUTIONS
COMMUNITY CARE COORDINATION (C3) STRONG
Information Technology Requirements Business Critical
| Attachment 1 - Statement of Work | IT Review and Comments (Check / Complete as applicable) | |
| The following are business critical requirements that proposer must resond to. All Information Technology Requirements shall be incorporated as an Attachment to Exhibit A - Statement of Work. State Yes or No to indicate whether or not your solution will meet the requirement. If No, state what work is necessary to meet the requirement or how your solution will meet the requirements and the work necessary to meet the requirements - indicate costs if needed. Applicable product literature or technical documentation can be provided to support your response. |
The County will favor a response that substantially meets the Information Technology requirements outlined in this document. Should you take exception(s) to the requirements, you understand that the County may, as part of its evaluation process, conclude that exceptions are so material as to make the Offeror’s response to the solicitation unacceptable.
| Response # | Requirement Description | YES/NO | Vendor Response and Comments. | |
| Please describe how your product will comply with the requirement | Vendor response acceptable as stated | Vendor response acceptable as modified below (re-state) | Vendor No confirmation and comments can be reserved | |
| MR-1 | The solution shall protect the privacy of customer personal identifiable information (PII) in accordance with Federal and State regulations. Please describe how the solution meets the requirements. | |||
| MR-2 | All support for the solution shall be provided from locations within the borders of the United States including customer service and non-client facing technology and infrastructure support personnel. | |||
| MR-3 | All data processed and stored by this solution shall only traverse networks contained within the borders of the United States. | |||
| MR-4 | Endpoint Detection & Response (EDR) or Anti-Malware protection software shall be installed on all systems supporting the solution. Please describe the specific software that the solution uses. | |||
| MR-5 | Solution shall support data in-transit encryption, including but not limited to: |
1. Client to server communications
2. Server to server communications
3. Database communications
4. API communications
5. List any unencrypted data-in-transit instances the solution requires MR-6 The solution shall support data encryption for all data at rest including:
1. Disk level encryption
2. Database/Storage/Share Encryption
3. File level encryption
| MR-7 | The solution product development teams shall not have access to production infrastructure and/or production data. |
| MR-8 | All application and system integration credentials shall be integrated with the County's external identity provider including: |
a. Application Service to Application Service credentials
b. Application Service to Database credentials
c. API credentials MR-9 The solution must prevent the following items from being stored/hardcoded within the source code:
1. Passwords
2. API keys
3. Certificates
4. Tokens
5. Hashes
6. Anything considered secret
| MR-10 | All cryptographic functions performed within the solution (e.g., data encryption, key management, hashing, digital signatures) shall utilize FIPS 140-3 validated cryptographic modules. Any cryptographic module employed for data-in-transit or data-at-rest encryption, as well as authentication protocols, shall meet or exceed the requirements as defined in NIST FIPS 140-3 (Security Requirements for Cryptographic Modules) and NIST SP 800-131Ar2 (Transitioning the Use of Cryptographic Algorithms and Key Lengths). | |
| MR-11 | All solutions, systems, and applications within the environment shall not use the following deprecated or legacy protocols and ciphers, due to known security vulnerabilities and/or insufficient cryptographic protection: | |
| • | SSLv2.0/SSLv3.0 | |
| • | TLS 1.0/TLS 1.1 | |
| • | SMBv1/SMBv2 | |
| • | LM/NTLMv1/NTLMv2 | |
| • | FTP without TLS | |
| • | SSHv1 | |
| MR-12 | Contractor shall provide a SOC 2 report as requested by the County. Contractor will furnish the Department with a copy of Contractor’s annual independent service auditor’s report on Contractor’s controls relevant to security, availability, processing integrity, confidentiality, and privacy. The SOC audit report must be a type 2 report that includes management’s description of Contractor’s system and the suitability of the design controls set forth in AICPA Trust Services Criteria Section 100 (2017). This independent audit of the Contractor’s controls must be completed in accordance with the AICPA SSAE No. 18 (SOC 2, Type 2). The SSAE 18 (SOC 2, Type 2) annual audit will include all programs under the Contract and will be conducted at the Contractor’s expense. If the Contractor’s SSAE 18 (SOC 2, Type 2) audit covers less than twelve (12) months of a calendar year, the Contractor will provide a bridge letter to the Department, stating whether processes and controls have changed since the SSAE 18 (SOC 2, Type 2) audit. In addition, the Department requires Contractor to submit a letter of attestation indicating Contractor’s receipt of management’s assertion of control compliance from Contractor’s subcontractors. | |
| MR-13 | Solution shall comply with the follow laws and standards: Health Insurance Portability and Accountability Act (HIPAA) of 1996, Fair Labor Standards Act (FLSA)Occupation Safety and Health Act (OSHA) Protecting PII - Privacy Act, | |
| MR-14 | The solution shall provide audit logging for (you will be asked to demonstrate each of these): 1. Successful user login and logoff |
2. Log on attempt and failed data access attempts
3. System and application file access
4. System change attempts
5. User and Service account changes, including
a. Account creation
b. Account role changes/modification
c. Deletion
6. Use of privileged user account
7. All changes to security configuration, including:
a. User access changes
b. Deletion of audit logs MR-15 The solution shall retain audit logs within the server or application as appropriate for data classification and special mandates imposed by state and federal laws:
- Health Insurance Portability and Accountability Act (HIPAA) retention minimum of six (7) years per California Cal. Code Regs. Title 22, 72543
| MR-16 | The solution shall provide logs for edits and additions made to business data to include the date / time stamp and editor identification. |
| MR-17 | The solution shall have all actions with the software application log for attribution to a specific user. |
Moderate Baseline Requirements
| County of San Diego Baseline Security Requirements Checklist | ||||
| Control Section | Requirement | Yes | No | Exception Explanation |
| AC - Access Control | Solution must be able enforce restrictive controls for administrative access, system or application changes, and change/delete access to audit logs | |||
| AC - Access Control | Solution must utilize role-based access to prevent user acess to unapproved content | |||
| AC - Access Control | Solution must display any required approprite privacy and security banners | |||
| AC - Access Control | For systems capable of external sharing, solution must have the ability to authorize, control and limit external sharing | |||
| AU - Audit and Accountability | Solution should have a Security Information and Event Management (SIEM) solution | |||
| AU - Audit and Accountability | Solutions security tools should integrate with a SIEM solution | |||
| AU - Audit and Accountability | Solution security audit logs must be protected from unauthorized access, modification or deletion | |||
| CA - Security Assessment and Authorization | Supplier maintains a current SOC 2 Type II audit report prepared by a third party auditor consisting of a comprehensive internal controls assessment covering the internal controls and information security posture of the contracted service or product. | |||
| CM - Configuration Management | Solution must only utilize technologies and components that are actively supported by maintenance contracts | |||
| CM - Configuration Management | Solution should provide Integrated Change Notification | |||
| CP - Contingency Planning | Solution must provide a daily backup solution | |||
| CP - Contingency Planning | Solution should maintain at a minimum of 180 days of application backup data | |||
| CP - Contingency Planning | Solution must include a viable, annually-tested Disaster Recovery plan | |||
| IA - Identification and Authentication | Solution must be able to integrate with County Identity Provider and Single Sign-on (SAML 2.0, OAUTH or WS-Federation integration). If yes, please indicate which Single Sign-on capability (SAML 2.0, OAUTH or WS-Federation integration) vendor supports. | |||
| IA - Identification and Authentication | Solution must ensure the information system uniquely identifies and authenticates all users | |||
| IA - Identification and Authentication | Solution should provide multi-factor authentication (MFA) | |||
| IA - Identification and Authentication | Solution must ensure information system default account passwords are changed prior to release to production | |||
| IA - Identification and Authentication | Solution must not store passwords or API keys inside source code | |||
| IA - Identification and Authentication | Solution must support periodic application and service account password changes including changing all default administrator passwords, at least annually | |||
| IA - Identification and Authentication | Solution must store and transmit passwords in an encrypted format so that passwords do not display in a clear text | |||
| IR - Incident Response | Solution provider must have a published breach disclosure policy | |||
| IR - Incident Response | Solution should be supported by a 24x7x365 Security Operations Center | |||
| IR - Incident Response | Solution provider must maintain and regularly test an Incident Response Plan and provide investigation support in a breach | |||
| RA - Risk Assessments | Solution provider must perform Penetration Testing annually | |||
| RA - Risk Assessments | Solution provider must ensure vendor-defined high severity and above information system vulnerabilities are remediated prior to release to production | |||
| RA - Risk Assessments | Vulnerability scanning is performed at least weekly for operating systems, system components, dynamic web applications and static code analysis | |||
| RA - Risk Assessments | Security patches for vendor-defined high severity and above vulnerabilities must be implemented within 30 days of availability | |||
| RA - Risk Assessments | Vulnerability mitigations must be put in place for vendor-defined high and above severity vulnerabilities while a full patch is being developed | |||
| SA - System and Services Acquisition | Solution adheres to a privacy policy that discloses the ways the provider gathers, uses, discloses and manages customer data | |||
| SA - System and Services Acquisition | Solution provider must not share County data with another party without explicit permission of the customer | |||
| SA - System and Services Acquisition | All support for the solution must be provided from or at locations within the geographic boundaries of the United States | |||
| SA - System and Services Acquisition | All data stored and processed by the solution must remain within the geographic boundaries of the United States | |||
| SC - System and Communications Protection | Solution must ensure the information system is configured to protect against (or limit the effectiveness of) denial of service attacks | |||
| SC - System and Communications Protection | Solution must ensure the information system monitors and controls communication at the external boundary of the system and at key internal boundaries (such as development) within the system | |||
| SC - System and Communications Protection | Solution's APIs/open interfaces must be secured and encrypted | |||
| SI - System and Information Integrity | Solution must incorporate anti-malware protection at network and host platform levels | |||
| SI - System and Information Integrity | Solution must ensure the information system employs malicious code protection at information system entry and exit points to detect and eradicate malicious code | |||
| SI - System and Information Integrity | Solution must ensure the information system malicious code protection is configured to perform periodic scans and real-time scans of files from external sources as they are downloaded, opened, or executed | |||
| SI - System and Information Integrity | Solution must ensure the information system malicious code protection must block or quarantine malicious code and send an alert to an administrator in response to malicious code detection | |||
| SI - System and Information Integrity | Solution must ensure the information system must be capable of detecting and preventing attacks and indicators of potential attacks and ensure all events are forwarded to the Security Incident and Event Manager | |||
| SI - System and Information Integrity | Solution must have a Firewall | |||
| SI - System and Information Integrity | Solution should have or integrate with a web application firewall (WAF) | |||
| SI - System and Information Integrity | Solution must encrypt data at rest | |||
| SI - System and Information Integrity | Solution must encrypt data in transit | |||
| SI - System and Information Integrity | Multitenant solutions must support partitioning of County data | |||
| SI - System and Information Integrity | Solution must incorporate intrusion prevention and detection capabilities |
Sensitive PII
| County of San Diego Sensitive PII Security Requirements Checklist | ||||
| Control Section | Requirement | Yes | No | Exception Explanation |
| AC - Access Control | Solution shall control access to PII through access control policies and access enforcement mechanisms e.g. RBAC, Least Priviledged, Encryption | |||
| AU - Audit and Accountability | Solution must monitor events that affect the confidentiality of PII, such as unauthorized access to PII | |||
| IA - Identification and Authentication | Solution must be able to uniquely identify and authenticate users before accessing PII |
| MP - Media Protection | Solution must Sanitize digital and non-digital media containing PII before it is disposed e.g. degaussing |
| SC - System and Communications Protection | Solution must protect the confidentiality of transmitted PII and All data in transmitted must be encrypted |
| SC - System and Communications Protection | Solution must protect the confidentiality of PII at rest and all PII Data at rest must be encrypted. |
| SI - System and Information Integrity | Solution must employ automated tools to monitor PII internally or at network boundaries for unusual or suspicious transfers or events e.g. DLP/SIEM |
EPHI HIPAA
| County of San Diego HIPAA Security Requirements Checklist | ||||
| Control Section | Requirement | Yes | No | Exception Explanation |
| AC - Access Control | Solution must assign a unique name and/or number for identifying and tracking user identities | |||
| AC - Access Control | Solution provider must implement procedures for obtaining and restricting access to County of San Diego electronic protected health information | |||
| AC - Access Control | Solution must implement electronic procedures that terminates an electronic session after 15 minutes of inactivity | |||
| AC - Access Control | Solution must implement a mechanism to encrypt and decrypt electronic protected health information | |||
| AC - Access Control | Solution provider must implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed | |||
| AC - Access Control | If a healthcare clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization | |||
| AT - Awareness and Training | Solution provider must implement a security awareness and training program for all members of its workforce (including management) including periodic security updates at least annually | |||
| AU - Audit and Accountability | Solution provide must implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports | |||
| AU - Audit and Accountability | Implements procedures for monitoring log-in attempts and reporting discrepancies | |||
| Solution provider must implement event audit logging of |
1. System and application file access.
2. System change attempts.
3. User and Service account changes, including:
a. Account creation.
b. Account role changes/modification.
c. Deletion.
4. Use of privileged user account.
5. The application logs activities of privileged users.
6. Changes to the security configuration (e.g. change of user(s) privileges, deletion of audit log, etc.) of the solution logged.
| CA - Security Assessment and Authorization | Solution provider must provide a security official or privacy officer who is responsible for the development and implementation of the policies and procedures required by this subpart for the entity |
| CA - Security Assessment and Authorization | Solution provider must perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of electronic protected health information that establishes the extent to which an entity’s security policies and procedures meet the requirements of this subpart |
| CP - Contingency Planning | Solution provider must implement policies and procedures to protect electronic protected health information from improper alteration or destruction |
| CP - Contingency Planning | Solution provider must implement policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information |
| CP - Contingency Planning | Solution provider must implement procedures to restore any loss of county data |
| CP - Contingency Planning | Solution provider must implement procedures to enable continuation of critical business processes for protection of the security of county of San Diego electronic protected health information while operating in emergency mode |
| CP - Contingency Planning | Solution provider must implement procedures for periodic testing and revision of contingency plans |
| CP - Contingency Planning | Solution provider must implement procedures that authorizes and documents the provider facility access in support of restoration of lost county data under the disaster recovery plan and emergency mode operations plan in the event of an emergency |
| CP - Contingency Planning | Solution provider must implement procedures to create a retrievable exact copy of county of San Diego electronic protected health information, when needed, before movement of equipment |
| IA - Identification and Authentication | Solution provider must implement procedures to verify that a person or entity seeking access to county of San Diego electronic protected health information is the one claimed |
| IA - Identification and Authentication | Solution provider must Implement procedures for creating, changing, and safeguarding passwords |
| IR - Incident Response | Solution provider must have an Incident Response Plan that documents and implement policies and procedures to: |
* Identify and respond to suspected or known security incidents
* Mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity
* Documents security incidents and their outcomes
| MA - Maintenance | Solution provider must implement policies and procedures to document repairs and modifications to the physical components of a facility which are related to security (for example, hardware, walls, doors, and locks) |
| MP - Media Protection | Solution provider must implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain county of San Diego electronic protected health information into and out of a facility, and the movement of these items within the facility |
| MP - Media Protection | Solution provider must implement policies and procedures to address the final disposition of county of San Diego electronic protected health information and/or the hardware or electronic media on which it is stored |
| MP - Media Protection | Solution provider must implement procedures for removal of county of San Diego electronic protected health information from electronic media before the media are made available for reuse. |
| MP - Media Protection | Solution provider must maintain a record of the movements of hardware and electronic media and any person responsible therefore |
| PE - Physical and Environmental Protection | Solution provider must implement policies and procedures to limit physical access to County of San Diego electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed |
| PE - Physical and Environmental Protection | Solution provider must implement procedures to control and validate a person's access to facilities based on their role or function, including visitor control, and control of access to software programs for testing and revision |
| PS - Personnel Security | Solution provider must implement procedures to determine the physical access of a workforce member to county of San Diego electronic protected health information is appropriate |
| PS - Personnel Security | Solution provider must implement procedures for terminating access to County of San Diego electronic protected health information when the employment of a workforce member ends or as required by determinations made |
| PL - Planning | Solution provider must implement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft |
| RA - Risk Assessments | Solution provider must perform Penetration Testing annually |
| RA - Risk Assessments | Solution provider must implement policies and procedures to prevent, detect, contain, and correct security violations |
| RA - Risk Assessments | Solution provider must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or hybrid entity |
| RA - Risk Assessments | Solution provider risk assessment procedures must assign a likelihood and impact for relevant threats and vulnerabilities assign a risk rating for relevant threats and vulnerabilities. |
| RA - Risk Assessments | Solution provider must implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with §164.306(a) |
| SC - System and Communications Protection | Solution provider must implement electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner |
| SC - System and Communications Protection | Solution provider must implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network |
| SC - System and Communications Protection | Solution provider must implement a mechanism to encrypt county of San Diego electronic protected health information in transit and at rest to meet at least the minimum NIST standards |
| SI - System and Information Integrity | Solution must detect, prevent and report malicious software use |
Project Req
| Requirement Number | Requirement Description | Supported | Comments |
| Project requirements | |||
| System Documentation Requirements | |||
| T-230 | Online help on system functionality is to be a component of the online system | ||
| T-231 | Online help can be searched based on screen, job function, process name, nouns so that user can find help by topic | ||
| T-232, P-165 | System documentation includes product user guides | ||
| T-233 | System documentation includes technical manuals | ||
| T-234 | System documentation includes data model, tables and attributes | ||
| T-235 | System documentation can be exported into a format that can be annotated electronically and then stored, i.e. product documentation does not need to be re-typed to create custom training material or custom business process documentation | ||
| T-236 | System documentation is available in electronic format that may be stored on county computers | ||
| T-238 | Custom documentation on business processes is developed as part of the project | ||
| T-239 | Custom documentation on configurations and customization made to base product are developed as part of the project | ||
| T-240 | Custom documentation on installation procedures for configurations, customization are developed as part of the project |
| System Training Requirements | |
| T-241 | Training materials need to be accessible online and indexed by job function or process name. |
| T-242, P-166 | Training materials include detail user steps to complete job functions. |
| T-243 | Training materials are provided in electronic format. |
| T-244 | Training class are defined, materials written, classes conducted for end user training, super user training and system application support staff are developed as part of the project |
| WW-189 | Training will be hands-on practical on the installed system, using helpful training documents. |
| Data Extraction, Data Conversion, Data Loading | ||
| T-245 | Data from existing EAM systems, custom Access databases, and excel spreadsheets is extracted, transformed and loaded into new EAM as part of the project | With error messaging on load problems |
| T-246 | Defining the data mapping from existing EAM data sources into the new EAM system is part of the project | |
| WW-190 | Data conversion services as required to transfer existing County data into the new EAM. |
&"Arial,Bold"&14&A
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
File details come from the government source that posted it. Updated .