TEXAS DEPARTMENT OF AGRICULTURE

COMMISSIONER SID MILLER

EXHIBIT K: DATA SECURITY REQUIREMENTS

P.O. BOX 12847 TEXASAGRICULTURE.GOV PHONE: (512) 463-7476

AUSTIN, TEXAS 78711 FAX: (888) 223-8861

PCO Exhibit K Revised 12/20/2024 Page 2 of 2

1. To ensure rigorous and robust data security, Respondent shall implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect from unlawful use or disclosure any sensitive personal information or agency data collected or maintained by Respondent. This duty extends throughout the term of the contract, if any, resulting from this solicitation.

2. Authorization.

a. In accordance with Texas Government Code, Section 2054.0593 and

Texas Business and Commerce Code, Sections 521.052-.053, Contractor shall:

i. meet security requirements outlined in NIST SP 800-53 or meet all TX-RAMP requirements to protect all Personally Identifying Information (PII);

ii. provide quarterly update, scanning, and vulnerability reports to TDA’s IT department describing all incidents;

iii. report any breach of systems immediately and according to TDA’s incident response requirements (report within 24 hours, resolve within 72 hours);

iv. provide an itemized list of individual(s) whose PII has been compromised as defined by Texas Business and Commerce Code, Section 521.053;

v. adhere to the Payment Card Industry Data Security Standard when processing payments;

vi. ensure all PII data is encrypted when stored or transmitted and only transmitted via encrypted connections;

vii. establish password standards that include: a 10-character minimum requirement comprised of one uppercase, one lowercase, at least one number, and one special character with the option of using multi-factor authentication in addition to the password; and

viii. ensure certificate authentication using TLS 1.2 or above for HTTPS on port 443 or other secure port.

EXHIBIT K: DATA SECURITY REQUIREMENTS

P.O. BOX 12847 TEXASAGRICULTURE.GOV PHONE: (512) 463-7476

AUSTIN, TEXAS 78711 FAX: (888) 223-8861

b. Contractor’s hardware infrastructure and software configuration must be:

i. TX-RAMP compliant and

ii. be OWASP compliant for the web application that is client-facing.

c. If requested, Contractor will:

i. provide quarterly security reports to TDA’s Information Security

Officer detailing vulnerability tests and remediation efforts With vulnerability remediation efforts adhering to TX-RAMP guidelines available at the following link: TX-RAMP Control Baselines 2.0 | Texas Department of Information Resources;

ii. ii. provide proof of background checks for all Contractor personnel whose responsibilities include managing and having access to PII, including contractors that may have services subcontracted, i.e.

vendor-awarded contract third parties;

iii. ensure data encryption that is at least AES 128 -bit compliant for applications;

iv. provide basic network diagrams upon request; and

v. provide disaster recovery plan as well as in the event of any security issue, Contractor must email TDA’s Information Security Officer (ISO) Wesley Williams at Wesley.Williams@TexasAgriculture.gov and Chief Information Officer (CIO) Chris Bunton at Chris.Bunton@TexasAgriculture.gov.

d. Contractors must provide vulnerability reports to the Contract

Manager and TDA’s ISO by the first business day of every quarter (90 days) throughout the term of the contract and any renewal options.

Vulnerability remediation efforts need to meet TX-RAMP guidelines.

See the following link for TX-Ramp Control Baseline TX-RAMP Control Baselines 2.0 | Texas Department of Information Resources.

e. Contractor must provide a Service Organization Controls Report (SOC 2 – Type 2) annually or a Bridge Letter by the first business day after September 1st of every year of the contract to TDA’s CIO https://dir.texas.gov/resource-library-item/tx-ramp-control-baselines-20 https://dir.texas.gov/resource-library-item/tx-ramp-control-baselines-20 mailto:Wesley.Williams@TexasAgriculture.gov mailto:Chris.Bunton@TexasAgriculture.gov https://dir.texas.gov/resource-library-item/tx-ramp-control-baselines-20 https://dir.texas.gov/resource-library-item/tx-ramp-control-baselines-20

EXHIBIT K: DATA SECURITY REQUIREMENTS

P.O. BOX 12847 TEXASAGRICULTURE.GOV PHONE: (512) 463-7476

AUSTIN, TEXAS 78711 FAX: (888) 223-8861

at Chris.Bunton@TexasAgriculture.gov and TDA’s ISO at Wesley.Williams@TexasAgriculture.gov.

f. Cloud Computing State Risk and Authorization Management Program. Pursuant to Section 2054.0593(d)-(f) of the Texas Government Code, relating to cloud computing state risk and authorization management program, Respondent represents and warrants that it complies with the requirements of the state risk and authorization management program and Respondent agrees that throughout the term of the contract, if any, it shall maintain its certifications and comply with the program requirements in the performance of the contract.

Printed Name:

Respondent Signature:

Title:

Date:

mailto:Chris.Bunton@TexasAgriculture.gov mailto:Wesley.Williams@TexasAgriculture.gov