Exhibit M, Texas Health and Human Services Information Security and Privacy Controls.pdf

RFQ No. HHS0017782 Exhibit M

RFQ No. HHS0017782

Exhibit M

Texas Health and Human Services

Information Security and Privacy Requirements

STANDARDS AND REGULATIONS:

Contractor is required to comply with HHS Information Security and Privacy requirements to maintain a business relationship with Texas HHS. Accordingly, contractors are required to adhere to all applicable standards and regulations (and their associated security controls) to include state laws, federal laws, executive orders, policies, regulations, standards, and guidance.

STANDARDS AND REGULATIONS THAT APPLY TO THIS CONTRACT:

Based on data types that are accessed, created, disclosed, received, transmitted, maintained, or stored within Information System(s) of this contract the following standards and regulations apply:

A. TEXAS HHS REQUIREMENTS:

The Contractor is responsible for implementing the HHS (NIST SP 800-53R5 equivalent) security baseline and the DIR overlays found in the IS-Controls and the following Texas HHS standards and regulations:

• Information Security Controls (IS-Controls)

• Information Security Risk Management Policy

• Security and Privacy Inquiry (SPI)

• Information Security Acceptable Use Policy

B. STATE AND FEDERAL REQUIREMENTS:

The Contractor is additionally responsible for implementing following state and federal standards and regulations:

• Texas Department of Information Resources (DIR) Security Control

Standards Catalog

• Texas Risk and Authorization Management Program (TX-RAMP)

• TX-RAMP Security Controls Baselines

• Texas Administrative Coded (TAC) 202

• Texas Government Code (TGC) 2054

• Texas Cybersecurity Framework Controls (TCSF) and Definitions

• NIST Special Publication 800-53 (Rev. 5) Security and Privacy Controls for

Information Systems and Organizations Center for Medicaid & Medicare

Services Minimum Acceptable Risk Security and Privacy Controls for

Exchanges (CMS-MARS-E)

• NIST Special Publication 800-53 (Rev. 5) Security and Privacy Controls for

Information Systems and Organizations Health Insurance Portability and

Accountability Act of 1996 (HIPAA); NIST SP 800-66, An Introductory

Resource Guide for Implementing the HIPAA Security Rule; US Department

Exhibit M of Health and Human Services HIPAA Security Rule Crosswalk to NIST

Cybersecurity Framework

• NIST Special Publication 800-53 (Rev. 5) Security and Privacy Controls for

Information Systems and Organizations

CONTRACT MONITORING:

Contractor is required to fulfill HHS monitoring requirements for continuing compliance as outlined in the Information Security Risk Management Policy.

REQUIRED INFORMATION SECURITY & PRIVACY CONTROLS THAT

APPLY TO THIS CONTRACT:

Table 1 below is a list of required security controls mandated by the applicable state and federal regulations listed above. The contractor must implement the following list of Information Security and Privacy controls unless there is a documented agreement establishing Texas Health and Human Services as the provider for a specified control(s).

Also, the contractor must implement any additional controls added or modified in subsequent updates to applicable standards and regulations.

If more than one applicable Standard and Regulation requires the same Information

Security and Privacy control, then the contractor must implement the most restrictive requirements for the specified control.

Table 1: Information Security & Privacy Controls Minimum Baseline that applies to this

Contract.

Control ID Control Name

AC-01 Access Control Policy and Procedures

AC-02 Account Management

AC-02(01) Account Management | Automated System Account Management

AC-02(02) Account Management | Automated Temporary and Emergency

Account Management

AC-02(03) Account Management | Disable Accounts

AC-02(04) Account Management | Automated Audit Actions

AC-02(05) Account Management | Inactivity Logout

AC-02(13) Account Management | Disable Accounts for High-risk Individuals

AC-03 Access Enforcement

AC-04 Information Flow Enforcement

AC-05 Separation of Duties

Exhibit M

AC-06 Least Privilege

AC-06(01) Least Privilege | Authorize Access to Security Functions

AC-06(02) Least Privilege | Non-privileged Access for Nonsecurity Functions

AC-06(05) Least Privilege | Privileged Accounts

AC-06(07) Least Privilege | Review of User Privileges

AC-06(09) Least Privilege | Log Use of Privileged Functions

AC-06(10) Least Privilege | Prohibit Non-privileged Users from Executing

Privileged Functions

AC-07 Unsuccessful Logon Attempts

AC-08 System Use Notification

AC-11 Device Lock

AC-11(01) Device Lock | Pattern-hiding Displays

AC-12 Session Termination

AC-14 Permitted Actions Without Identification or Authentication

AC-16 Security and Privacy Attributes

AC-17 Remote Access

AC-17(01) Remote Access | Monitoring and Control

AC-17(02) Remote Access | Protection of Confidentiality and Integrity Using

Encryption

AC-17(03) Remote Access | Managed Access Control Points

AC-17(04) Remote Access | Privileged Commands and Access

AC-18 Wireless Access

AC-18(01) Wireless Access | Authentication and Encryption

AC-18(03) Wireless Access | Disable Wireless Networking

AC-19 Access Control for Mobile Devices

AC-19(05) Access Control for Mobile Devices | Full Device or Container-based

Encryption

Exhibit M

AC-20 Use of External Systems

AC-20(01) Use of External Systems | Limits on Authorized Use

AC-20(02) Use of External Systems | Portable Storage Devices — Restricted Use

AC-21 Information Sharing

AC-22 Publicly Accessible Content

AT-01 Awareness and Training Policy and Procedures

AT-02 Literacy Training and Awareness

AT-02(02) Literacy Training and Awareness | Insider Threat

AT-02(03) Literacy Training and Awareness | Social Engineering and Mining

AT-03 Role-based Training

AT-04 Training Records

AU-01 Audit and Accountability Policy and Procedures

AU-02 Event Logging

AU-03 Content of Audit Records

AU-03(01) Content of Audit Records | Additional Audit Information

AU-04 Audit Log Storage Capacity

AU-05 Response to Audit Logging Process Failures

AU-06 Audit Record Review, Analysis, and Reporting

AU-06(01) Audit Record Review, Analysis, and Reporting | Automated Process

Integration

AU-06(03) Audit Record Review, Analysis, and Reporting | Correlate Audit

Record Repositories

AU-07 Audit Record Reduction and Report Generation

AU-07(01) Audit Record Reduction and Report Generation | Automatic

Processing

AU-08 Time Stamps

AU-09 Protection of Audit Information

Exhibit M

AU-09(04) Protection of Audit Information | Access by Subset of Privileged Users

AU-11 Audit Record Retention

AU-12 Audit Record Generation

CA-01 Assessment, Authorization, and Monitoring Policy and Procedures

CA-02 Control Assessments

CA-02(01) Control Assessments | Independent Assessors

CA-03 Information Exchange

CA-05 Plan of Action and Milestones

CA-06 Authorization

CA-07 Continuous Monitoring

CA-07(01) Continuous Monitoring | Independent Assessment

CA-07(04) Continuous Monitoring | Risk Monitoring

CA-08 Penetration Testing

CA-09 Internal System Connections

CM-01 Configuration Management Policy and Procedures

CM-02 Baseline Configuration

CM-02(02) Baseline Configuration | Automation Support for Accuracy and

Currency

CM-02(03) Baseline Configuration | Retention of Previous Configurations

CM-02(07) Baseline Configuration | Configure Systems and Components for

High-risk Areas

CM-03 Configuration Change Control

CM-03(02) Configuration Change Control | Testing, Validation, and

Documentation of Changes

CM-03(04) Configuration Change Control | Security and Privacy Representatives

CM-04 Impact Analyses

CM-04(02) Impact Analyses | Verification of Controls

Exhibit M

CM-05 Access Restrictions for Change

CM-06 Configuration Settings

CM-07 Least Functionality

CM-07(01) Least Functionality | Periodic Review

CM-07(02) Least Functionality | Prevent Program Execution

CM-07(05) Least Functionality | Authorized Software — Allow-by-exception

CM-08 System Component Inventory

CM-08(01) System Component Inventory | Updates During Installation and

Removal

CM-08(03) System Component Inventory | Automated Unauthorized Component

Detection

CM-09 Configuration Management Plan

CM-10 Software Usage Restrictions

CM-11 User-installed Software

CM-12 Information Location

CM-12(01) Information Location | Automated Tools to Support Information

Location

CP-01 Contingency Planning Policy and Procedures

CP-02 Contingency Plan

CP-02(01) Contingency Plan | Coordinate with Related Plans

CP-02(03) Contingency Plan | Resume Mission and Business Functions

CP-02(08) Contingency Plan | Identify Critical Assets

CP-03 Contingency Training

CP-04 Contingency Plan Testing

CP-04(01) Contingency Plan Testing | Coordinate with Related Plans

CP-06 Alternate Storage Site

CP-06(01) Alternate Storage Site | Separation from Primary Site

Exhibit M

CP-06(03) Alternate Storage Site | Accessibility

CP-07 Alternate Processing Site

CP-07(01) Alternate Processing Site | Separation from Primary Site

CP-07(02) Alternate Processing Site | Accessibility

CP-07(03) Alternate Processing Site | Priority of Service

CP-08 Telecommunications Services

CP-08(01) Telecommunications Services | Priority of Service Provisions

CP-08(02) Telecommunications Services | Single Points of Failure

CP-09 System Backup

CP-09(01) System Backup | Testing for Reliability and Integrity

CP-09(08) System Backup | Cryptographic Protection

CP-10 System Recovery and Reconstitution

CP-10(02) System Recovery and Reconstitution | Transaction Recovery

CP-11 Alternate Communications Protocols

IA-01 Identification and Authentication Policy and Procedures

IA-02 Identification and Authentication (organizational Users)

IA-02(01) Identification and Authentication (organizational Users) | Multi-factor

Authentication to Privileged Accounts

IA-02(02) Identification and Authentication (organizational Users) | Multi-factor

Authentication to Non-privileged Accounts

IA-02(08) Identification and Authentication (organizational Users) | Access to

Accounts — Replay Resistant

IA-02(12) Identification and Authentication (organizational Users) | Acceptance of PIV Credentials

IA-03 Device Identification and Authentication

IA-04 Identifier Management

IA-04(04) Identifier Management | Identify User Status

IA-05 Authenticator Management

Exhibit M

IA-05(01) Authenticator Management | Password-based Authentication

IA-05(02) Authenticator Management | Public Key-based Authentication

IA-05(06) Authenticator Management | Protection of Authenticators

IA-06 Authentication Feedback

IA-07 Cryptographic Module Authentication

IA-08 Identification and Authentication (non-organizational Users)

IA-08(01) Identification and Authentication (non-organizational Users) |

Acceptance of PIV Credentials from Other Agencies

IA-08(02) Identification and Authentication (non-organizational Users) |

Acceptance of External Authenticators

IA-08(04) Identification and Authentication (non-organizational Users) | Use of

Defined Profiles

IA-09 Service Identification and Authentication

IA-11 Re-authentication

IA-12 Identity Proofing

IA-12(02) Identity Proofing | Identity Evidence

IA-12(03) Identity Proofing | Identity Evidence Validation and Verification

IA-12(05) Identity Proofing | Address Confirmation

IR-01 Incident Response Policy and Procedures

IR-02 Incident Response Training

IR-03 Incident Response Testing

IR-03(02) Incident Response Testing | Coordination with Related Plans

IR-04 Incident Handling

IR-04(01) Incident Handling | Automated Incident Handling Processes

IR-05 Incident Monitoring

IR-06 Incident Reporting

IR-06(01) Incident Reporting | Automated Reporting

Exhibit M

IR-06(03) Incident Reporting | Supply Chain Coordination

IR-07 Incident Response Assistance

IR-07(01) Incident Response Assistance | Automation Support for Availability of

Information and Support

IR-08 Incident Response Plan

IR-09 Information Spillage Response

MA-01 Maintenance Policy and Procedures

MA-02 Controlled Maintenance

MA-03 Maintenance Tools

MA-03(01) Maintenance Tools | Inspect Tools

MA-03(02) Maintenance Tools | Inspect Media

MA-03(03) Maintenance Tools | Prevent Unauthorized Removal

MA-04 Nonlocal Maintenance

MA-05 Maintenance Personnel

MA-06 Timely Maintenance

MP-01 Media Protection Policy and Procedures

MP-02 Media Access

MP-03 Media Marking

MP-04 Media Storage

MP-05 Media Transport

MP-06 Media Sanitization

MP-06(01) Media Sanitization | Review, Approve, Track, Document, and Verify

MP-07 Media Use

PE-01 Physical and Environmental Protection Policy and Procedures

PE-02 Physical Access Authorizations

PE-03 Physical Access Control

Exhibit M

PE-03(01) Physical Access Control | System Access

PE-04 Access Control for Transmission

PE-05 Access Control for Output Devices

PE-06 Monitoring Physical Access

PE-06(01) Monitoring Physical Access | Intrusion Alarms and Surveillance

Equipment

PE-08 Visitor Access Records

PE-09 Power Equipment and Cabling

PE-10 Emergency Shutoff

PE-11 Emergency Power

PE-12 Emergency Lighting

PE-13 Fire Protection

PE-13(01) Fire Protection | Detection Systems — Automatic Activation and

Notification

PE-14 Environmental Controls

PE-15 Water Damage Protection

PE-16 Delivery and Removal

PE-17 Alternate Work Site

PE-18 Location of System Components

PE-20 Asset Monitoring and Tracking

PL-01 Planning Policy and Procedures

PL-02 System Security and Privacy Plans

PL-04 Rules of Behavior

PL-04(01) Rules of Behavior | Social Media and External Site/application Usage

Restrictions

PL-08 Security and Privacy Architectures

PL-10 Baseline Selection

Exhibit M

PL-11 Baseline Tailoring

PM-01 Program Management Information Security Program Plan

PM-02 Information Security Program Leadership Role

PM-03 Information Security and Privacy Resources

PM-04 Plan of Action and Milestones Process

PM-05 System Inventory

PM-06 Measures of Performance

PM-07 Enterprise Architecture

PM-09 Risk Management Strategy

PM-10 Authorization Process

PM-14 Testing, Training, and Monitoring

PM-15 Security and Privacy Groups and Associations

PM-16 Threat Awareness Program

PS-01 Personnel Security Policy and Procedures

PS-02 Position Risk Designation

PS-03 Personnel Screening

PS-04 Personnel Termination

PS-05 Personnel Transfer

PS-06 Access Agreements

PS-07 External Personnel Security

PS-08 Personnel Sanctions

PS-09 Position Descriptions

RA-01 Risk Assessment Policy and Procedures

RA-02 Security Categorization

RA-03 Risk Assessment

RA-03(01) Risk Assessment | Supply Chain Risk Assessment

Exhibit M

RA-05 Vulnerability Monitoring and Scanning

RA-05(02) Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be

Scanned

RA-05(05) Vulnerability Monitoring and Scanning | Privileged Access

RA-05(11) Vulnerability Monitoring and Scanning | Public Disclosure Program

RA-07 Risk Response

RA-09 Criticality Analysis

SA-01 System and Services Acquisition Policy and Procedures

SA-02 Allocation of Resources

SA-03 System Development Life Cycle

SA-04 Acquisition Process

SA-04(01) Acquisition Process | Functional Properties of Controls

SA-04(02) Acquisition Process | Design and Implementation Information for

Controls

SA-04(09) Acquisition Process | Functions, Ports, Protocols, and Services in Use

SA-04(10) Acquisition Process | Use of Approved PIV Products

SA-05 System Documentation

SA-08 Security and Privacy Engineering Principles

SA-09 External System Services

SA-09(02) External System Services | Identification of Functions, Ports, Protocols, and Services

SA-10 Developer Configuration Management

SA-11 Developer Testing and Evaluation

SA-15 Development Process, Standards, and Tools

SA-15(03) Development Process, Standards, and Tools | Criticality Analysis

SA-22 Unsupported System Components

SC-01 System and Communications Protection Policy and Procedures

Exhibit M

SC-02 Separation of System and User Functionality

SC-04 Information in Shared System Resources

SC-05 Denial-of-service Protection

SC-07 Boundary Protection

SC-07(03) Boundary Protection | Access Points

SC-07(04) Boundary Protection | External Telecommunications Services

SC-07(05) Boundary Protection | Deny by Default — Allow by Exception

SC-07(07) Boundary Protection | Split Tunneling for Remote Devices

SC-07(08) Boundary Protection | Route Traffic to Authenticated Proxy Servers

SC-08 Transmission Confidentiality and Integrity

SC-08(01) Transmission Confidentiality and Integrity | Cryptographic Protection

SC-10 Network Disconnect

SC-12 Cryptographic Key Establishment and Management

SC-13 Cryptographic Protection

SC-15 Collaborative Computing Devices and Applications

SC-17 Public Key Infrastructure Certificates

SC-18 Mobile Code

SC-20 Secure Name/address Resolution Service (authoritative Source)

SC-21 Secure Name/address Resolution Service (recursive or Caching

Resolver)

SC-22 Architecture and Provisioning for Name/address Resolution Service

SC-23 Session Authenticity

SC-28 Protection of Information at Rest

SC-28(01) Protection of Information at Rest | Cryptographic Protection

SC-39 Process Isolation

SI-01 System and Information Integrity Policy and Procedures

Exhibit M

SI-02 Flaw Remediation

SI-02(02) Flaw Remediation | Automated Flaw Remediation Status

SI-03 Malicious Code Protection

SI-04 System Monitoring

SI-04(02) System Monitoring | Automated Tools and Mechanisms for Real-time

Analysis

SI-04(04) System Monitoring | Inbound and Outbound Communications Traffic

SI-04(05) System Monitoring | System-generated Alerts

SI-05 Security Alerts, Advisories, and Directives

SI-07 Software, Firmware, and Information Integrity

SI-07(01) Software, Firmware, and Information Integrity | Integrity Checks

SI-07(07) Software, Firmware, and Information Integrity | Integration of

Detection and Response

SI-08 Spam Protection

SI-08(02) Spam Protection | Automatic Updates

SI-10 Information Input Validation

SI-11 Error Handling

SI-12 Information Management and Retention

SI-16 Memory Protection

SR-01 Supply Chain Risk Management Policy and Procedures

SR-02 Supply Chain Risk Management Plan

SR-02(01) Supply Chain Risk Management Plan | Establish SCRM Team

SR-03 Supply Chain Controls and Processes

SR-05 Acquisition Strategies, Tools, and Methods

SR-06 Supplier Assessments and Reviews

SR-08 Notification Agreements

SR-10 Inspection of Systems or Components

Exhibit M

SR-11 Component Authenticity

SR-11(01) Component Authenticity | Anti-counterfeit Training

SR-11(02) Component Authenticity | Configuration Control for Component

Service and Repair

SR-12 Component Disposal