Exhibit A _ RP034_25 _ Security Requirements .docx

Exhibit A

Cloud Solution Standards

Implementation & Migration

· Vendors must clearly disclose whether Professional Services are required for solution implementation or data migration.

· If Professional Services are included in the scope, the attached Professional Services Standards apply.

· Any associated costs, timelines, and resource requirements must be documented.

Security & Compliance Certifications

· Vendors must provide a SOC 2 Type II report covering the entire technology stack—excluding inherited reports from infrastructure providers like AWS, Azure, or GCP.

· Solutions must meet relevant compliance standards, including but not limited to:

· FedRAMP

· SOC 2

· HIPAA

· PCI-DSS

· CJIS

Personnel & Security Vetting

· Employee Background Checks

· Vendors must perform background checks on employees accessing sensitive County data.

· Must provide evidence of checks upon request.

· Sensitive data includes:

· Personally Identifiable Information (PII) as defined by Georgia law

· Data regulated by PCI, HIPAA, CJIS, or other legal frameworks

Data Sovereignty & Storage

· Vendors must disclose the geographic location of data storage.

· Clear policies must be in place for data sovereignty, ensuring compliance with local and federal regulations.

Authentication & Access Control

· Solutions must support:

· Multi-Factor Authentication (MFA)

· Single Sign-On (SSO) via SAML, OAuth, or similar protocols

Data Segmentation

· County or agency data must be logically or physically segmented from other customers to prevent unauthorized access or data leakage.

Encryption Standards

· All data must be encrypted:

· At rest using industry-standard encryption (e.g., AES-256)

· In transit using secure protocols (e.g., TLS 1.2 or higher) Backup & Disaster Recovery

· Vendors must provide:

· A defined backup frequency (e.g., daily, hourly)

· A comprehensive disaster recovery plan, including Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)

Incident Response & Monitoring

· Vendors must maintain a documented incident response protocol, including breach notification timelines and mitigation procedures.

· Vendors and subcontractors must notify Gwinnett County within 24 hours in writing if a security breach involves:

· County-owned data, accounts, or systems

· Systems compromised while connected to the County network (including VPN)

· Any event reasonably expected to impact the County’s security posture

· Solutions must include:

· Security event detection

· Audit logging with retention policies

Third-Party Subcontractors

· If third-party subcontractors are used:

· They must adhere to the same security and compliance standards as the primary vendor.

· Their roles and responsibilities must be transparently disclosed.

· All contractual requirements apply equally to vendors and subcontractors.

Data Retention & Deletion

· Vendors must define:

· Retention policies for inactive or terminated accounts

· Secure deletion procedures for purging data upon request or contract termination

· Vendors may not share County-owned data (including network diagrams or system information) with third parties unless explicitly authorized.

· Vendors must delete County-owned data at contract termination unless legally prohibited or otherwise authorized.

Service Level Agreements (SLAs)

· Vendors must offer:

· Uptime guarantees (e.g., 99.9% availability)

· Clearly defined SLA terms, including penalties for non-compliance

Professional Services Standards

Data Access and Security

· Vendor must disclose whether personnel will access County systems or sensitive data.

· Access must be role-based, time-bound, and logged.

· Background checks required for personnel accessing sensitive systems.

· Multi-factor authentication (MFA) must be used for system access.

Subcontracting and Data Protection

· Vendor must identify all subcontractors and their roles.

· Subcontractors must comply with the same data protection standards as the primary vendor.

· Data shared with subcontractors must be encrypted in transit and at rest.

· Vendor must maintain a data-sharing agreement with each subcontractor.

Incident Response and Data Disclosure

· Vendor must have a documented incident response plan.

· Any inadvertent data disclosure must be reported to the County within 24 hours.

· Vendor must cooperate with County-led investigations and provide full disclosure.

· Remediation steps must be outlined and executed promptly.

Cybersecurity and Privacy Training

· All vendor personnel must complete annual cybersecurity and data privacy training.

· Training must include phishing awareness, secure data handling, and regulatory compliance, if applicable (e.g., HIPAA, PCI-DSS, CJIS, FERPA).

· Training records must be available upon request.

Data Disposal and Post-Engagement Protocols

· Vendor must securely dispose of County data using NIST 800-88 or equivalent standards.

· All digital and physical records must be deleted or returned within 30 days of engagement completion.

· Certificate of data destruction must be provided to the County.

Secure Communication Standards

· Vendor must use encrypted email, secure file transfer protocols (SFTP), or secure portals for all County communications.

· Public cloud file-sharing services (e.g., Dropbox, Google Drive) are prohibited unless approved by the County.

· Communication logs must be retained for audit purposes.

Document Retention and Archiving

· Vendor must comply with County document retention policies (Georgia Government Retention Schedules) and applicable state/federal laws.

· Retention schedules must be clearly defined in the contract.

· County-related materials must not be retained beyond the agreed period unless legally required.