Exhibit I - HHS Information Security and Privacy.pdf
PDF 212 KB Posted
- Attached to
- Take Charge Texas Support Services
- Solicitation number
- HHS0014612v2
- Issued by
- Texas
About this file
This is an exhibit document detailing the Information Security and Privacy Requirements for the Texas Health and Human Services Commission (HHSC) under RFO HHS0014612v2 for the Take Charge Texas Support Services contract. The exhibit establishes mandatory compliance standards and security controls that the contractor must implement and maintain throughout the contract period. The requirements are based on the data types accessed, created, disclosed, received, transmitted, maintained, or stored within the information systems used for this contract. The contractor is responsible for implementing the HHS Moderate security baseline equivalent to NIST SP 800-53R5, along with DIR and HIPAA overlays. Additionally, the contractor must comply with Texas Department of Information Resources (DIR) Security Control Standards Catalog, Texas Risk and Authorization Management Program (TX-RAMP) for cloud systems, the Health Insurance Portability and Accountability Act (HIPAA), NIST SP 800-66 guidance, and Section 508 of the Rehabilitation Act for accessibility compliance.
The exhibit provides a comprehensive table of over 200 specific Information Security and Privacy controls organized by control family that the contractor must implement unless Texas HHS documents an agreement to serve as the provider for specified controls. These controls encompass access control, account management, audit and accountability, security assessment and authorization, configuration management, contingency planning, identification and authentication, incident response, system maintenance, media protection, physical and environmental protection, security planning, personnel security, risk assessment, system and services acquisition, system and communications protection, system and information integrity, and privacy requirements. The contractor is required to implement the most restrictive requirements when multiple standards or regulations mandate the same control, and must implement any additional controls added or modified in subsequent updates to applicable standards and regulations. Ongoing contract monitoring will be conducted in accordance with the Information Security Risk Assessment Monitoring Process (IS-RAMP) to ensure continuing compliance with all security and privacy requirements.
View the file
Other files
Show all 38
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Exhibit I – HHS Information Security and Privacy Requirements
HHS RFO No. HHS0014612v2
EXHIBIT I
HHS INFORMATION SECURITY AND PRIVACY REQUIREMENTS
RFO HHS0014612v2
Standards and Regulations:
Contractor must comply with HHS Information Security and Privacy Requirements to maintain a business relationship with Texas HHS. Accordingly, Contractor must adhere to all applicable standards and regulations (and their associated security controls) to include State laws, federal laws, executive orders, policies, regulations, standards, and guidance.
Standards and Regulations that Apply to this Contract:
Based on data types that are accessed, created, disclosed, received, transmitted, maintained, or stored within Information System(s) of this Contract the following standards and regulations apply:
Texas HHS Requirements:
The Contractor is responsible for implementing the HHS Moderate (NIST SP 800-53R5
Moderate equivalent) security baseline and the DIR, HIPAA overlays found in the IS-Controls and the following Texas HHS standards and regulations:
• Information Security Controls (IS-Controls)
• Information Security Risk Assessment Monitoring Process (IS-RAMP)
• Security and Privacy Inquiry (SPI)
• Information Security Web & Mobile Standard (IS-Web & Mobile)
State and Federal Requirements:
The Contractor is additionally responsible for implementing following State and federal standards and regulations:
• Texas Department of Information Resources (DIR) Security Control Standards Catalog
• Texas Risk and Authorization Management Program (TX-RAMP) compliant for Cloud systems.
• Health Insurance Portability and Accountability Act of 1996 (HIPAA); NIST SP 800-66, An Introductory Resource Guide for Implementing the HIPAA Security Rule; US
Department of Health and Human Services HIPAA Security Rule Crosswalk to NIST
Cybersecurity Framework
• 508c compliant. Section 508 of the Rehabilitation Act (29 U.S.C. 794d), as amended in
1998, is a federal law that requires agencies to provide individuals with disabilities equal access to electronic information and data.
Contract Monitoring:
The Contractor is required to fulfill HHS monitoring requirements for continuing compliance as outlined in the IS-RAMP.
Required Information Security & Privacy Controls that Apply to this Contract:
Table 1 below is a list of required security controls mandated by the applicable State and federal regulations listed above. The Contractor must implement the following list of Information
Security and Privacy controls unless there is a documented agreement establishing Texas Health and Human Services as the provider for a specified control(s).
Additionally, the Contractor must implement any additional controls added or modified in subsequent updates to applicable standards and regulations.
If more than one applicable Standard and/or Regulation requires the same Information Security and Privacy control, then the contractor must implement the most restrictive requirements for the specified control.
Table 1: Information Security & Privacy Controls Minimum Baseline that apply to this Contract
Control ID Control Name
AC-01 ACCESS CONTROL POLICY AND PROCEDURES
AC-02 ACCOUNT MANAGEMENT
AC-02(01) AUTOMATED SYSTEM ACCOUNT MANAGEMENT
AC-02(02) REMOVAL OF TEMPORARY / EMERGENCY ACCOUNTS
AC-02(03) DISABLE INACTIVE ACCOUNTS
AC-02(04) AUTOMATED AUDIT ACTIONS
AC-03 ACCESS ENFORCEMENT
AC-04 INFORMATION FLOW ENFORCEMENT
AC-05 Separation of Duties
AC-06 Least Privilege
AC-06(01) AUTHORIZE ACCESS TO SECURITY FUNCTIONS
AC-06(02) NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS
AC-06(05) PRIVILEGED ACCOUNTS
AC-06(09) AUDITING USE OF PRIVILEGED FUNCTIONS
AC-06(10) PROHIBIT NON-PRIVILEGED USERS FROM EXECUTING PRIVILEGED
FUNCTIONS
AC-07 Unsuccessful Logon Attempts
AC-08 SYSTEM USE NOTIFICATION
AC-11 Session Lock
AC-11(01) PATTERN-HIDING DISPLAYS
AC-12 Session Termination
AC-14 PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION
AC-16 SECURITY ATTRIBUTES
AC-17 REMOTE ACCESS
AC-17(01) AUTOMATED MONITORING / CONTROL
AC-17(02) PROTECTION OF CONFIDENTIALITY / INTEGRITY USING ENCRYPTION
AC-17(03) MANAGED ACCESS CONTROL POINTS
AC-17(04) PRIVILEGED COMMANDS / ACCESS
AC-18 WIRELESS ACCESS
AC-18(01) AUTHENTICATION AND ENCRYPTION
AC-19 ACCESS CONTROL FOR MOBILE DEVICES
AC-19(05) FULL DEVICE / CONTAINER-BASED ENCRYPTION
AC-20 USE OF EXTERNAL INFORMATION SYSTEMS
AC-20(01) LIMITS ON AUTHORIZED USE
AC-20(02) PORTABLE STORAGE DEVICES
AC-21 INFORMATION SHARING
AC-22 PUBLICLY ACCESSIBLE CONTENT
AR-01 GOVERNANCE AND PRIVACY PROGRAM
AT-01 SECURITY AWARENESS AND TRAINING POLICY AND PROCEDURES
AT-02 SECURITY AWARENESS TRAINING
AT-02(02) INSIDER THREAT
AT-03 ROLE-BASED SECURITY TRAINING
AT-04 SECURITY TRAINING RECORDS
AU-01 AUDIT AND ACCOUNTABILITY POLICY AND PROCEDURES
AU-02 AUDIT EVENTS
AU-02(03) REVIEWS AND UPDATES
AU-03 CONTENT OF AUDIT RECORDS
AU-03(01) ADDITIONAL AUDIT INFORMATION
AU-04 AUDIT STORAGE CAPACITY
AU-05 RESPONSE TO AUDIT PROCESSING FAILURES
AU-06 AUDIT REVIEW, ANALYSIS, AND REPORTING
AU-06(01) PROCESS INTEGRATION
AU-06(03) CORRELATE AUDIT REPOSITORIES
AU-07 AUDIT REDUCTION AND REPORT GENERATION
AU-07(01) AUTOMATIC PROCESSING
AU-08 TIME STAMPS
AU-08(01) SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE
AU-09 PROTECTION OF AUDIT INFORMATION
AU-09(04) ACCESS BY SUBSET OF PRIVILEGED USERS
AU-11 AUDIT RECORD RETENTION
AU-12 AUDIT GENERATION
AU-13 MONITORING FOR INFORMATION DISCLOSURE
CA-01 SECURITY ASSESSMENT AND AUTHORIZATION POLICY AND PROCEDURES
CA-02 SECURITY ASSESSMENTS
CA-02(01) INDEPENDENT ASSESSORS
CA-03 System Interconnections
CA-03(05) RESTRICTIONS ON EXTERNAL SYSTEM CONNECTIONS
CA-05 PLAN OF ACTION AND MILESTONES
CA-05(01) AUTOMATION SUPPORT FOR ACCURACY / CURRENCY
CA-06 SECURITY AUTHORIZATION
CA-07 CONTINUOUS MONITORING
CA-07(01) INDEPENDENT ASSESSMENT
CA-08 PENETRATION TESTING
CA-09 INTERNAL SYSTEM CONNECTIONS
CM-01 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES
CM-02 BASELINE CONFIGURATION
CM-02(01) REVIEWS AND UPDATES
CM-02(03) RETENTION OF PREVIOUS CONFIGURATIONS
CM-03 CONFIGURATION CHANGE CONTROL
CM-03(02) TEST / VALIDATE / DOCUMENT CHANGES
CM-04 SECURITY IMPACT ANALYSIS
CM-04(01) SEPARATE TEST ENVIRONMENTS
CM-05 ACCESS RESTRICTIONS FOR CHANGE
CM-06 CONFIGURATION SETTINGS
CM-07 LEAST FUNCTIONALITY
CM-07(01) PERIODIC REVIEW
CM-07(02) PREVENT PROGRAM EXECUTION
CM-07(04) UNAUTHORIZED SOFTWARE / BLACKLISTING
CM-08 Information System Component Inventory
CM-08(01) UPDATES DURING INSTALLATIONS / REMOVALS
CM-08(03) AUTOMATED UNAUTHORIZED COMPONENT DETECTION
CM-08(05) NO DUPLICATE ACCOUNTING OF COMPONENTS
CM-09 CONFIGURATION MANAGEMENT PLAN
CM-10 SOFTWARE USAGE RESTRICTIONS
CM-11 USER-INSTALLED SOFTWARE
CP-01 CONTINGENCY PLANNING POLICY AND PROCEDURES
CP-02 CONTINGENCY PLAN
CP-02(01) COORDINATE WITH RELATED PLANS
CP-02(03) RESUME ESSENTIAL MISSIONS / BUSINESS FUNCTIONS
CP-02(05) CONTINUE ESSENTIAL MISSIONS / BUSINESS FUNCTIONS
CP-02(08) IDENTIFY CRITICAL ASSETS
CP-03 CONTINGENCY TRAINING
CP-04 Contingency Plan Testing
CP-04(01) COORDINATE WITH RELATED PLANS
CP-06 ALTERNATE STORAGE SITE
CP-06(01) SEPARATION FROM PRIMARY SITE
CP-06(03) ACCESSIBILITY
CP-07 ALTERNATE PROCESSING SITE
CP-07(01) SEPARATION FROM PRIMARY SITE
CP-07(02) ACCESSIBILITY
CP-07(03) PRIORITY OF SERVICE
CP-08 TELECOMMUNICATIONS SERVICES
CP-08(01) PRIORITY OF SERVICE PROVISIONS
CP-08(02) SINGLE POINTS OF FAILURE
CP-09 INFORMATION SYSTEM BACKUP
CP-09(01) TESTING FOR RELIABILITY / INTEGRITY
CP-10 INFORMATION SYSTEM RECOVERY AND RECONSTITUTION
CP-10(02) TRANSACTION RECOVERY
CP-11 ALTERNATE COMMUNICATIONS PROTOCOLS
IA-01 IDENTIFICATION AND AUTHENTICATION POLICY AND PROCEDURES
IA-02 IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)
IA-02(01) NETWORK ACCESS TO PRIVILEGED ACCOUNTS
IA-02(08) NETWORK ACCESS TO PRIVILEGED ACCOUNTS - REPLAY RESISTANT
IA-02(11) REMOTE ACCESS - SEPARATE DEVICE
IA-03 DEVICE IDENTIFICATION AND AUTHENTICATION
IA-04 IDENTIFIER MANAGEMENT
IA-05 AUTHENTICATOR MANAGEMENT
IA-05(01) PASSWORD-BASED AUTHENTICATION
IA-05(02) PKI-BASED AUTHENTICATION
IA-05(03) IN-PERSON OR TRUSTED THIRD-PARTY REGISTRATION
IA-05(07) NO EMBEDDED UNENCRYPTED STATIC AUTHENTICATORS
IA-05(11) HARDWARE TOKEN-BASED AUTHENTICATION
IA-06 AUTHENTICATOR FEEDBACK
IA-07 CRYPTOGRAPHIC MODULE AUTHENTICATION
IA-08 IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS)
IP-01 CONSENT
IR-01 INCIDENT RESPONSE POLICY AND PROCEDURES
IR-02 INCIDENT RESPONSE TRAINING
IR-03 INCIDENT RESPONSE TESTING
IR-03(02) COORDINATION WITH RELATED PLANS
IR-04 INCIDENT HANDLING
IR-04(01) AUTOMATED INCIDENT HANDLING PROCESSES
IR-05 INCIDENT MONITORING
IR-06 INCIDENT REPORTING
IR-06(01) AUTOMATED REPORTING
IR-07 INCIDENT RESPONSE ASSISTANCE
IR-07(01) AUTOMATION SUPPORT FOR AVAILABILITY OF INFORMATION / SUPPORT
IR-08 INCIDENT RESPONSE PLAN
MA-01 SYSTEM MAINTENANCE POLICY AND PROCEDURES
MA-02 CONTROLLED MAINTENANCE
MA-03 MAINTENANCE TOOLS
MA-03(01) INSPECT TOOLS
MA-03(02) INSPECT MEDIA
MA-04 NONLOCAL MAINTENANCE
MA-04(02) DOCUMENT NONLOCAL MAINTENANCE
MA-05 MAINTENANCE PERSONNEL
MA-06 TIMELY MAINTENANCE
MP-01 MEDIA PROTECTION POLICY AND PROCEDURES
MP-02 MEDIA ACCESS
MP-03 MEDIA MARKING
MP-04 MEDIA STORAGE
MP-05 MEDIA TRANSPORT
MP-05(04) CRYPTOGRAPHIC PROTECTION
MP-06 MEDIA SANITIZATION
MP-07 MEDIA USE
MP-07(01) PROHIBIT USE WITHOUT OWNER
PE-01 PHYSICAL AND ENVIRONMENTAL PROTECTION POLICY AND PROCEDURES
PE-02 PHYSICAL ACCESS AUTHORIZATIONS
PE-03 PHYSICAL ACCESS CONTROL
PE-04 ACCESS CONTROL FOR TRANSMISSION MEDIUM
PE-05 ACCESS CONTROL FOR OUTPUT DEVICES
PE-06 MONITORING PHYSICAL ACCESS
PE-06(01) INTRUSION ALARMS / SURVEILLANCE EQUIPMENT
PE-08 VISITOR ACCESS RECORDS
PE-09 POWER EQUIPMENT AND CABLING
PE-10 EMERGENCY SHUTOFF
PE-11 EMERGENCY POWER
PE-12 EMERGENCY LIGHTING
PE-13 FIRE PROTECTION
PE-13(03) AUTOMATIC FIRE SUPPRESSION
PE-14 TEMPERATURE AND HUMIDITY CONTROLS
PE-15 WATER DAMAGE PROTECTION
PE-16 DELIVERY AND REMOVAL
PE-17 ALTERNATE WORK SITE
PE-18 LOCATION OF INFORMATION SYSTEM COMPONENTS
PE-19 INFORMATION LEAKAGE
PE-20 ASSET MONITORING AND TRACKING
PL-01 SECURITY PLANNING POLICY AND PROCEDURES
PL-02 System Security Plan
PL-02(03) PLAN / COORDINATE WITH OTHER ORGANIZATIONAL ENTITIES
PL-04 RULES OF BEHAVIOR
PL-04(01) SOCIAL MEDIA AND NETWORKING RESTRICTIONS
PL-08 INFORMATION SECURITY ARCHITECTURE
PM-01 INFORMATION SECURITY PROGRAM PLAN
PM-02 SENIOR INFORMATION SECURITY OFFICER
PM-03 INFORMATION SECURITY RESOURCES
PM-04 PLAN OF ACTION AND MILESTONES PROCESS
PM-05 INFORMATION SYSTEM INVENTORY
PM-06 INFORMATION SECURITY MEASURES OF PERFORMANCE
PM-07 ENTERPRISE ARCHITECTURE
PM-08 CRITICAL INFRASTRUCTURE PLAN
PM-09 RISK MANAGEMENT STRATEGY
PM-10 SECURITY AUTHORIZATION PROCESS
PM-11 MISSION/BUSINESS PROCESS DEFINITION
PM-12 INSIDER THREAT PROGRAM
PM-13 INFORMATION SECURITY WORKFORCE
PM-14 TESTING, TRAINING, AND MONITORING
PM-15 CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS
PM-16 THREAT AWARENESS PROGRAM
PS-01 PERSONNEL SECURITY POLICY AND PROCEDURES
PS-02 POSITION RISK DESIGNATION
PS-03 PERSONNEL SCREENING
PS-04 PERSONNEL TERMINATION
PS-05 PERSONNEL TRANSFER
PS-06 ACCESS AGREEMENTS
PS-07 THIRD-PARTY PERSONNEL SECURITY
PS-08 PERSONNEL SANCTIONS
RA-01 RISK ASSESSMENT POLICY AND PROCEDURES
RA-02 SECURITY CATEGORIZATION
RA-03 RISK ASSESSMENT
RA-05 VULNERABILITY SCANNING
RA-05(01) UPDATE TOOL CAPABILITY
RA-05(02) UPDATE BY FREQUENCY / PRIOR TO NEW SCAN / WHEN IDENTIFIED
RA-05(05) PRIVILEGED ACCESS
SA-01 SYSTEM AND SERVICES ACQUISITION POLICY AND PROCEDURES
SA-02 ALLOCATION OF RESOURCES
SA-03 SYSTEM DEVELOPMENT LIFE CYCLE
SA-04 ACQUISITION PROCESS
SA-04(01) FUNCTIONAL PROPERTIES OF SECURITY CONTROLS
SA-04(02) DESIGN / IMPLEMENTATION INFORMATION FOR SECURITY CONTROLS
SA-04(09) FUNCTIONS / PORTS / PROTOCOLS / SERVICES IN USE
SA-05 INFORMATION SYSTEM DOCUMENTATION
SA-08 SECURITY ENGINEERING PRINCIPLES
SA-09 EXTERNAL INFORMATION SYSTEM SERVICES
SA-09(02) IDENTIFICATION OF FUNCTIONS / PORTS / PROTOCOLS / SERVICES
SA-09(05) PROCESSING, STORAGE, AND SERVICE LOCATION
SA-10 DEVELOPER CONFIGURATION MANAGEMENT
SA-11 DEVELOPER SECURITY TESTING AND EVALUATION
SA-11(01) STATIC CODE ANALYSIS
SA-11(02) THREAT AND VULNERABILITY ANALYSES
SA-11(05) PENETRATION TESTING
SA-11(08) DYNAMIC CODE ANALYSIS
SA-12 SUPPLY CHAIN PROTECTION
SA-14 CRITICALITY ANALYSIS
SA-15 DEVELOPMENT PROCESS, STANDARDS, AND TOOLS
SA-17 DEVELOPER SECURITY ARCHITECTURE AND DESIGN
SC-01 SYSTEM AND COMMUNICATIONS PROTECTION POLICY AND PROCEDURES
SC-02 APPLICATION PARTITIONING
SC-04 INFORMATION IN SHARED RESOURCES
SC-05 DENIAL OF SERVICE PROTECTION
SC-07 BOUNDARY PROTECTION
SC-07(03) ACCESS POINTS
SC-07(04) EXTERNAL TELECOMMUNICATIONS SERVICES
SC-07(05) DENY BY DEFAULT / ALLOW BY EXCEPTION
SC-07(07) PREVENT SPLIT TUNNELING FOR REMOTE DEVICES
SC-08 TRANSMISSION CONFIDENTIALITY AND INTEGRITY
SC-08(01) CRYPTOGRAPHIC OR ALTERNATE PHYSICAL PROTECTION
SC-10 NETWORK DISCONNECT
SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT
SC-13 CRYPTOGRAPHIC PROTECTION
SC-15 COLLABORATIVE COMPUTING DEVICES
SC-17 PUBLIC KEY INFRASTRUCTURE CERTIFICATES
SC-18 MOBILE CODE
SC-19 VOICE OVER INTERNET PROTOCOL
SC-20 SECURE NAME / ADDRESS RESOLUTION SERVICE (AUTHORITATIVE
SOURCE)
SC-21 SECURE NAME / ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING
RESOLVER)
SC-22 ARCHITECTURE AND PROVISIONING FOR NAME / ADDRESS RESOLUTION
SERVICE
SC-23 SESSION AUTHENTICITY
SC-28 PROTECTION OF INFORMATION AT REST
SC-28(01) CRYPTOGRAPHIC PROTECTION
SC-31 COVERT CHANNEL ANALYSIS
SC-39 PROCESS ISOLATION
SC-44 DETONATION CHAMBERS
SE-01 INVENTORY OF PERSONALLY IDENTIFIABLE INFORMATION
SI-01 SYSTEM AND INFORMATION INTEGRITY POLICY AND PROCEDURES
SI-02 Flaw Remediation
SI-02(02) AUTOMATED FLAW REMEDIATION STATUS
SI-03 MALICIOUS CODE PROTECTION
SI-03(01) CENTRAL MANAGEMENT
SI-03(02) AUTOMATIC UPDATES
SI-04 INFORMATION SYSTEM MONITORING
SI-04(02) AUTOMATED TOOLS FOR REAL-TIME ANALYSIS
SI-04(04) INBOUND AND OUTBOUND COMMUNICATIONS TRAFFIC
SI-04(05) SYSTEM-GENERATED ALERTS
SI-05 SECURITY ALERTS, ADVISORIES, AND DIRECTIVES
SI-07 SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY
SI-07(01) INTEGRITY CHECKS
SI-07(07) INTEGRATION OF DETECTION AND RESPONSE
SI-08 SPAM PROTECTION
SI-08(01) CENTRAL MANAGEMENT
SI-08(02) AUTOMATIC UPDATES
SI-10 INFORMATION INPUT VALIDATION
SI-11 Error Handling
SI-12 INFORMATION HANDLING AND RETENTION
SI-16 MEMORY PROTECTION
TR-01 PRIVACY NOTICE
UL-01 INTERNAL USE
File details come from the government source that posted it. Updated .