Exhibit L - Information Security and Privacy Requirements.pdf
PDF 155 KB Posted
- Attached to
- Video Directly Observed Therapy (“VDOT”)
- Solicitation number
- HHS0015558v2
- Issued by
- Texas
About this file
This is an Information Security and Privacy Requirements exhibit for a Texas Health and Human Services (HHS) contract related to Video Directly Observed Therapy (VDOT) services. The exhibit establishes comprehensive security and privacy compliance standards that contractors must implement and maintain throughout the contract term. Contractors are required to adhere to all applicable state and federal laws, executive orders, policies, regulations, standards, and guidance, including the HHS MODERATE security baseline (NIST SP 800-53R5 equivalent), HIPAA, and NCHHSTP overlays. Additionally, contractors must comply with Texas Department of Information Resources (DIR) Security Control Standards Catalog, NIST SP 800-66, the HIPAA Security Rule, and Center for Disease Control Data Security and Confidentiality Guidelines for HIV, Viral Hepatitis, Sexually Transmitted Disease, and Tuberculosis Programs. The exhibit requires ongoing contract monitoring to ensure continuing compliance with all specified security controls and mandates that contractors implement any additional controls added or modified in subsequent updates to applicable standards and regulations.
The exhibit details a comprehensive minimum baseline of 195 information security and privacy controls across 18 control families that contractors must implement, including access control, account management, audit and accountability, security assessments, configuration management, contingency planning, identification and authentication, incident response, system maintenance, media protection, physical and environmental protection, security planning, personnel security, risk assessment, system and services acquisition, system and communications protection, system and information integrity, and program management. Where multiple applicable standards or regulations mandate the same control, contractors must implement the most restrictive requirements. The controls encompass technical, operational, and management domains, addressing areas such as privileged access management, encryption requirements, role-based training, disaster recovery planning, vendor security assessments, and insider threat programs. Contractors are responsible for fulfilling all HHS monitoring requirements for continuing compliance as outlined in the Information Security Controls documentation, and may only deviate from implementing specified controls through documented agreements establishing Texas HHS as the provider for those particular controls.
View the file
Other files
Show all 21
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
HHS0015558v2 Page 1 of 13
Exhibit L
Information Security and Privacy Requirements
Standards and Regulations:
Contractors are required to comply with HHS Information Security and
Privacy requirements in order to maintain a business relationship with Texas
HHS. Accordingly, contractors are required to adhere to all applicable standards and regulations (and their associated security controls) to include state laws, federal laws, executive orders, policies, regulations, standards, and guidance.
Standards and Regulations that Apply to this Contract:
Based on data types that are accessed, created, disclosed, received, transmitted, maintained, or stored within Information System(s) of this contract the following standards and regulations apply:
Texas HHS Requirements:
The contractor is responsible for implementing the HHS MODERATE (NIST
SP 800-53R5 MODERATE equivalent) security baseline and the HIPAA, NCHHSTP overlays found in the IS-Controls and the following Texas HHS standards and regulations:
• Information Security Controls (IS-Controls)
• Vendor Security Assessment Report and Attestation Guideline
• Security and Privacy Inquiry (SPI)
• Information Security Web & Mobile Standard (IS-Web & Mobile)
State and Federal Requirements:
HHS0015558v2 Page 2 of 13
The contractor is additionally responsible for implementing following state and federal standards and regulations:
• Texas Department of Information Resources (DIR) Security Control
Standards Catalog
• Health Insurance Portability and Accountability Act of 1996 (HIPAA)
• NIST SP 800-66, An Introductory Resource Guide for Implementing the HIPAA Security Rule
• US Department of Health and Human Services HIPAA Security Rule
Crosswalk to NIST Cybersecurity Framework
• Center for Disease Control Data Security and Confidentiality Guidelines for HIV, Viral Hepatitis, Sexually Transmitted Disease, and Tuberculosis
Programs
Contract Monitoring:
Contractors are required to fulfill HHS monitoring requirements for continuing compliance as outlined in the IS Controls.
Required Information Security & Privacy Controls that Apply to this
Contract:
Table 1 below is a list of required security controls mandated by the applicable state and federal regulations listed above. The contractor is required to implement the following list of Information Security and Privacy controls unless there exists a documented agreement that establishes Texas
Health and Human Services as the provider for a specified control(s).
Additionally, the contractor is required to implement any additional controls added or modified in subsequent updates to applicable standards and regulations.
HHS0015558v2 Page 3 of 13
If more than one applicable Standard and/or Regulation requires the same
Information Security and Privacy control, then the contractor must implement the most restrictive requirements for the specified control.
Table 1: Information Security & Privacy Controls Minimum Baseline that apply to this Contract
Control ID Control Name
AC-01 ACCESS CONTROL POLICY AND PROCEDURES
AC-02 ACCOUNT MANAGEMENT
AC-02(01) AUTOMATED SYSTEM ACCOUNT MANAGEMENT
AC-02(02) REMOVAL OF TEMPORARY / EMERGENCY ACCOUNTS
AC-02(03) DISABLE INACTIVE ACCOUNTS
AC-02(04) AUTOMATED AUDIT ACTIONS
AC-03 ACCESS ENFORCEMENT
AC-04 INFORMATION FLOW ENFORCEMENT
AC-05 SEPARATION OF DUTIES
AC-06 LEAST PRIVILEGE
AC-06(01) AUTHORIZE ACCESS TO SECURITY FUNCTIONS
AC-06(02) NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS
AC-06(05) PRIVILEGED ACCOUNTS
AC-06(09) AUDITING USE OF PRIVILEGED FUNCTIONS
AC-06(10) PROHIBIT NON-PRIVILEGED USERS FROM EXECUTING PRIVILEGED
FUNCTIONS
AC-07 UNSUCCESSFUL LOGON ATTEMPTS
AC-08 SYSTEM USE NOTIFICATION
AC-11 SESSION LOCK
AC-11(01) PATTERN-HIDING DISPLAYS
AC-12 SESSION TERMINATION
AC-14 PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION
AC-16 SECURITY ATTRIBUTES
HHS0015558v2 Page 4 of 13
AC-17 REMOTE ACCESS
AC-17(01) AUTOMATED MONITORING / CONTROL
AC-17(02) PROTECTION OF CONFIDENTIALITY / INTEGRITY USING ENCRYPTION
AC-17(03) MANAGED ACCESS CONTROL POINTS
AC-17(04) PRIVILEGED COMMANDS / ACCESS
AC-18 WIRELESS ACCESS
AC-18(01) AUTHENTICATION AND ENCRYPTION
AC-19 ACCESS CONTROL FOR MOBILE DEVICES
AC-19(05) FULL DEVICE / CONTAINER-BASED ENCRYPTION
AC-20 USE OF EXTERNAL INFORMATION SYSTEMS
AC-20(01) LIMITS ON AUTHORIZED USE
AC-20(02) PORTABLE STORAGE DEVICES
AC-21 INFORMATION SHARING
AC-22 PUBLICLY ACCESSIBLE CONTENT
AT-01 SECURITY AWARENESS AND TRAINING POLICY AND PROCEDURES
AT-02 SECURITY AWARENESS TRAINING
AT-02(02) INSIDER THREAT
AT-03 ROLE-BASED SECURITY TRAINING
AT-04 SECURITY TRAINING RECORDS
AU-01 AUDIT AND ACCOUNTABILITY POLICY AND PROCEDURES
AU-02 AUDIT EVENTS
AU-02(03) REVIEWS AND UPDATES
AU-03 CONTENT OF AUDIT RECORDS
AU-03(01) ADDITIONAL AUDIT INFORMATION
AU-04 AUDIT STORAGE CAPACITY
AU-05 RESPONSE TO AUDIT PROCESSING FAILURES
AU-06 AUDIT REVIEW, ANALYSIS, AND REPORTING
AU-06(01) PROCESS INTEGRATION
HHS0015558v2 Page 5 of 13
AU-06(03) CORRELATE AUDIT REPOSITORIES
AU-07 AUDIT REDUCTION AND REPORT GENERATION
AU-07(01) AUTOMATIC PROCESSING
AU-08 TIME STAMPS
AU-08(01) SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE
AU-09 PROTECTION OF AUDIT INFORMATION
AU-09(04) ACCESS BY SUBSET OF PRIVILEGED USERS
AU-11 AUDIT RECORD RETENTION
AU-12 AUDIT GENERATION
AU-13 MONITORING FOR INFORMATION DISCLOSURE
CA-01 SECURITY ASSESSMENT AND AUTHORIZATION POLICY AND
PROCEDURES
CA-02 SECURITY ASSESSMENTS
CA-02(01) INDEPENDENT ASSESSORS
CA-03 SYSTEM INTERCONNECTIONS
CA-03(05) RESTRICTIONS ON EXTERNAL SYSTEM CONNECTIONS
CA-05 PLAN OF ACTION AND MILESTONES
CA-05(01) AUTOMATION SUPPORT FOR ACCURACY / CURRENCY
CA-06 SECURITY AUTHORIZATION
CA-07 CONTINUOUS MONITORING
CA-07(01) INDEPENDENT ASSESSMENT
CA-08 PENETRATION TESTING
CA-09 INTERNAL SYSTEM CONNECTIONS
CM-01 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES
CM-02 BASELINE CONFIGURATION
CM-02(01) REVIEWS AND UPDATES
CM-02(03) RETENTION OF PREVIOUS CONFIGURATIONS
CM-03 CONFIGURATION CHANGE CONTROL
CM-03(02) TEST / VALIDATE / DOCUMENT CHANGES
HHS0015558v2 Page 6 of 13
CM-04 SECURITY IMPACT ANALYSIS
CM-04(01) SEPARATE TEST ENVIRONMENTS
CM-05 ACCESS RESTRICTIONS FOR CHANGE
CM-06 CONFIGURATION SETTINGS
CM-07 LEAST FUNCTIONALITY
CM-07(01) PERIODIC REVIEW
CM-07(02) PREVENT PROGRAM EXECUTION
CM-07(04) UNAUTHORIZED SOFTWARE / BLACKLISTING
CM-08 INFORMATION SYSTEM COMPONENT INVENTORY
CM-08(01) UPDATES DURING INSTALLATIONS / REMOVALS
CM-08(03) AUTOMATED UNAUTHORIZED COMPONENT DETECTION
CM-08(05) NO DUPLICATE ACCOUNTING OF COMPONENTS
CM-09 CONFIGURATION MANAGEMENT PLAN
CM-10 SOFTWARE USAGE RESTRICTIONS
CM-11 USER-INSTALLED SOFTWARE
CP-01 CONTINGENCY PLANNING POLICY AND PROCEDURES
CP-02 CONTINGENCY PLAN
CP-02(01) COORDINATE WITH RELATED PLANS
CP-02(03) RESUME ESSENTIAL MISSIONS / BUSINESS FUNCTIONS
CP-02(05) CONTINUE ESSENTIAL MISSIONS / BUSINESS FUNCTIONS
CP-02(08) IDENTIFY CRITICAL ASSETS
CP-03 CONTINGENCY TRAINING
CP-04 CONTINGENCY PLAN TESTING
CP-04(01) COORDINATE WITH RELATED PLANS
CP-06 ALTERNATE STORAGE SITE
CP-06(01) SEPARATION FROM PRIMARY SITE
CP-06(03) ACCESSIBILITY
CP-07 ALTERNATE PROCESSING SITE
HHS0015558v2 Page 7 of 13
CP-07(01) SEPARATION FROM PRIMARY SITE
CP-07(02) ACCESSIBILITY
CP-07(03) PRIORITY OF SERVICE
CP-08 TELECOMMUNICATIONS SERVICES
CP-08(01) PRIORITY OF SERVICE PROVISIONS
CP-08(02) SINGLE POINTS OF FAILURE
CP-09 INFORMATION SYSTEM BACKUP
CP-09(01) TESTING FOR RELIABILITY / INTEGRITY
CP-10 INFORMATION SYSTEM RECOVERY AND RECONSTITUTION
CP-10(02) TRANSACTION RECOVERY
CP-11 ALTERNATE COMMUNICATIONS PROTOCOLS
IA-01 IDENTIFICATION AND AUTHENTICATION POLICY AND PROCEDURES
IA-02 IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)
IA-02(01) NETWORK ACCESS TO PRIVILEGED ACCOUNTS
IA-02(08) NETWORK ACCESS TO PRIVILEGED ACCOUNTS - REPLAY RESISTANT
IA-02(11) REMOTE ACCESS - SEPARATE DEVICE
IA-03 DEVICE IDENTIFICATION AND AUTHENTICATION
IA-04 IDENTIFIER MANAGEMENT
IA-05 AUTHENTICATOR MANAGEMENT
IA-05(01) PASSWORD-BASED AUTHENTICATION
IA-05(02) PKI-BASED AUTHENTICATION
IA-05(03) IN-PERSON OR TRUSTED THIRD-PARTY REGISTRATION
IA-05(07) NO EMBEDDED UNENCRYPTED STATIC AUTHENTICATORS
IA-05(11) HARDWARE TOKEN-BASED AUTHENTICATION
IA-06 AUTHENTICATOR FEEDBACK
IA-07 CRYPTOGRAPHIC MODULE AUTHENTICATION
IA-08 IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL
USERS)
IR-01 INCIDENT RESPONSE POLICY AND PROCEDURES
HHS0015558v2 Page 8 of 13
IR-02 INCIDENT RESPONSE TRAINING
IR-03 INCIDENT RESPONSE TESTING
IR-03(02) COORDINATION WITH RELATED PLANS
IR-04 INCIDENT HANDLING
IR-04(01) AUTOMATED INCIDENT HANDLING PROCESSES
IR-05 INCIDENT MONITORING
IR-06 INCIDENT REPORTING
IR-06(01) AUTOMATED REPORTING
IR-07 INCIDENT RESPONSE ASSISTANCE
IR-07(01) AUTOMATION SUPPORT FOR AVAILABILITY OF INFORMATION /
SUPPORT
IR-08 INCIDENT RESPONSE PLAN
MA-01 SYSTEM MAINTENANCE POLICY AND PROCEDURES
MA-02 CONTROLLED MAINTENANCE
MA-03 MAINTENANCE TOOLS
MA-03(01) INSPECT TOOLS
MA-03(02) INSPECT MEDIA
MA-04 NONLOCAL MAINTENANCE
MA-04(02) DOCUMENT NONLOCAL MAINTENANCE
MA-05 MAINTENANCE PERSONNEL
MA-06 TIMELY MAINTENANCE
MP-01 MEDIA PROTECTION POLICY AND PROCEDURES
MP-02 MEDIA ACCESS
MP-03 MEDIA MARKING
MP-04 MEDIA STORAGE
MP-05 MEDIA TRANSPORT
MP-05(04) CRYPTOGRAPHIC PROTECTION
MP-06 MEDIA SANITIZATION
MP-07 MEDIA USE
HHS0015558v2 Page 9 of 13
MP-07(01) PROHIBIT USE WITHOUT OWNER
PE-01 PHYSICAL AND ENVIRONMENTAL PROTECTION POLICY AND
PROCEDURES
PE-02 PHYSICAL ACCESS AUTHORIZATIONS
PE-03 PHYSICAL ACCESS CONTROL
PE-04 ACCESS CONTROL FOR TRANSMISSION MEDIUM
PE-05 ACCESS CONTROL FOR OUTPUT DEVICES
PE-06 MONITORING PHYSICAL ACCESS
PE-06(01) INTRUSION ALARMS / SURVEILLANCE EQUIPMENT
PE-08 VISITOR ACCESS RECORDS
PE-09 POWER EQUIPMENT AND CABLING
PE-10 EMERGENCY SHUTOFF
PE-11 EMERGENCY POWER
PE-12 EMERGENCY LIGHTING
PE-13 FIRE PROTECTION
PE-13(03) AUTOMATIC FIRE SUPPRESSION
PE-14 TEMPERATURE AND HUMIDITY CONTROLS
PE-15 WATER DAMAGE PROTECTION
PE-16 DELIVERY AND REMOVAL
PE-17 ALTERNATE WORK SITE
PE-18 LOCATION OF INFORMATION SYSTEM COMPONENTS
PE-19 INFORMATION LEAKAGE
PE-20 ASSET MONITORING AND TRACKING
PL-01 SECURITY PLANNING POLICY AND PROCEDURES
PL-02 SYSTEM SECURITY PLAN
PL-02(03) PLAN / COORDINATE WITH OTHER ORGANIZATIONAL ENTITIES
PL-04 RULES OF BEHAVIOR
PL-04(01) SOCIAL MEDIA AND NETWORKING RESTRICTIONS
PL-08 INFORMATION SECURITY ARCHITECTURE
HHS0015558v2 Page 10 of 13
PS-01 PERSONNEL SECURITY POLICY AND PROCEDURES
PS-02 POSITION RISK DESIGNATION
PS-03 PERSONNEL SCREENING
PS-04 PERSONNEL TERMINATION
PS-05 PERSONNEL TRANSFER
PS-06 ACCESS AGREEMENTS
PS-07 THIRD-PARTY PERSONNEL SECURITY
PS-08 PERSONNEL SANCTIONS
RA-01 RISK ASSESSMENT POLICY AND PROCEDURES
RA-02 SECURITY CATEGORIZATION
RA-03 RISK ASSESSMENT
RA-05 VULNERABILITY SCANNING
RA-05(01) UPDATE TOOL CAPABILITY
RA-05(02) UPDATE BY FREQUENCY / PRIOR TO NEW SCAN / WHEN IDENTIFIED
RA-05(05) PRIVILEGED ACCESS
SA-01 SYSTEM AND SERVICES ACQUISITION POLICY AND PROCEDURES
SA-02 ALLOCATION OF RESOURCES
SA-03 SYSTEM DEVELOPMENT LIFE CYCLE
SA-04 ACQUISITION PROCESS
SA-04(01) FUNCTIONAL PROPERTIES OF SECURITY CONTROLS
SA-04(02) DESIGN / IMPLEMENTATION INFORMATION FOR SECURITY CONTROLS
SA-04(09) FUNCTIONS / PORTS / PROTOCOLS / SERVICES IN USE
SA-05 INFORMATION SYSTEM DOCUMENTATION
SA-08 SECURITY ENGINEERING PRINCIPLES
SA-09 EXTERNAL INFORMATION SYSTEM SERVICES
SA-09(02) IDENTIFICATION OF FUNCTIONS / PORTS / PROTOCOLS / SERVICES
SA-09(05) PROCESSING, STORAGE, AND SERVICE LOCATION
SA-10 DEVELOPER CONFIGURATION MANAGEMENT
HHS0015558v2 Page 11 of 13
SA-11 DEVELOPER SECURITY TESTING AND EVALUATION
SA-11(01) STATIC CODE ANALYSIS
SA-11(02) THREAT AND VULNERABILITY ANALYSES
SA-11(05) PENETRATION TESTING
SA-11(08) DYNAMIC CODE ANALYSIS
SA-12 SUPPLY CHAIN PROTECTION
SA-14 CRITICALITY ANALYSIS
SA-15 DEVELOPMENT PROCESS, STANDARDS, AND TOOLS
SA-17 DEVELOPER SECURITY ARCHITECTURE AND DESIGN
SC-01 SYSTEM AND COMMUNICATIONS PROTECTION POLICY AND
PROCEDURES
SC-02 APPLICATION PARTITIONING
SC-04 INFORMATION IN SHARED RESOURCES
SC-05 DENIAL OF SERVICE PROTECTION
SC-07 BOUNDARY PROTECTION
SC-07(03) ACCESS POINTS
SC-07(04) EXTERNAL TELECOMMUNICATIONS SERVICES
SC-07(05) DENY BY DEFAULT / ALLOW BY EXCEPTION
SC-07(07) PREVENT SPLIT TUNNELING FOR REMOTE DEVICES
SC-08 TRANSMISSION CONFIDENTIALITY AND INTEGRITY
SC-08(01) CRYPTOGRAPHIC OR ALTERNATE PHYSICAL PROTECTION
SC-10 NETWORK DISCONNECT
SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT
SC-13 CRYPTOGRAPHIC PROTECTION
SC-15 COLLABORATIVE COMPUTING DEVICES
SC-17 PUBLIC KEY INFRASTRUCTURE CERTIFICATES
SC-18 MOBILE CODE
SC-19 VOICE OVER INTERNET PROTOCOL
HHS0015558v2 Page 12 of 13
SC-20 SECURE NAME / ADDRESS RESOLUTION SERVICE (AUTHORITATIVE
SOURCE)
SC-21 SECURE NAME / ADDRESS RESOLUTION SERVICE (RECURSIVE OR
CACHING RESOLVER)
SC-22 ARCHITECTURE AND PROVISIONING FOR NAME / ADDRESS
RESOLUTION SERVICE
SC-23 SESSION AUTHENTICITY
SC-28 PROTECTION OF INFORMATION AT REST
SC-28(01) CRYPTOGRAPHIC PROTECTION
SC-31 COVERT CHANNEL ANALYSIS
SC-39 PROCESS ISOLATION
SC-44 DETONATION CHAMBERS
SI-01 SYSTEM AND INFORMATION INTEGRITY POLICY AND PROCEDURES
SI-02 FLAW REMEDIATION
SI-02(02) AUTOMATED FLAW REMEDIATION STATUS
SI-03 MALICIOUS CODE PROTECTION
SI-03(01) CENTRAL MANAGEMENT
SI-03(02) AUTOMATIC UPDATES
SI-04 INFORMATION SYSTEM MONITORING
SI-04(02) AUTOMATED TOOLS FOR REAL-TIME ANALYSIS
SI-04(04) INBOUND AND OUTBOUND COMMUNICATIONS TRAFFIC
SI-04(05) SYSTEM-GENERATED ALERTS
SI-05 SECURITY ALERTS, ADVISORIES, AND DIRECTIVES
SI-07 SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY
SI-07(01) INTEGRITY CHECKS
SI-07(07) INTEGRATION OF DETECTION AND RESPONSE
SI-08 SPAM PROTECTION
SI-08(01) CENTRAL MANAGEMENT
SI-08(02) AUTOMATIC UPDATES
HHS0015558v2 Page 13 of 13
SI-10 INFORMATION INPUT VALIDATION
SI-11 ERROR HANDLING
SI-12 INFORMATION HANDLING AND RETENTION
SI-16 MEMORY PROTECTION
PM-01 INFORMATION SECURITY PROGRAM PLAN
PM-02 SENIOR INFORMATION SECURITY OFFICER
PM-03 INFORMATION SECURITY RESOURCES
PM-04 PLAN OF ACTION AND MILESTONES PROCESS
PM-05 INFORMATION SYSTEM INVENTORY
PM-06 INFORMATION SECURITY MEASURES OF PERFORMANCE
PM-07 ENTERPRISE ARCHITECTURE
PM-08 CRITICAL INFRASTRUCTURE PLAN
PM-09 RISK MANAGEMENT STRATEGY
PM-10 SECURITY AUTHORIZATION PROCESS
PM-11 MISSION/BUSINESS PROCESS DEFINITION
PM-12 INSIDER THREAT PROGRAM
PM-13 INFORMATION SECURITY WORKFORCE
PM-14 TESTING, TRAINING, AND MONITORING
PM-15 CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS
PM-16 THREAT AWARENESS PROGRAM
AR-01 GOVERNANCE AND PRIVACY PROGRAM
IP-01 CONSENT
SE-01 INVENTORY OF PERSONALLY IDENTIFIABLE INFORMATION
TR-01 PRIVACY NOTICE
UL-01 INTERNAL USE
File details come from the government source that posted it. Updated .