Exhibit P - HHS Information Security and Privacy Requirements.pdf

RFP HHS0017023 pg. 1 Exhibit P

Exhibit P - RFQ HHS0017023

Texas Health and Human Services

Information Security and Privacy Requirements

Standards and Regulations:

Contractors are required to comply with HHS Information Security and Privacy requirements in order to maintain a business relationship with Texas HHS. Accordingly, contractors are required to adhere to all applicable standards and regulations (and their associated security controls) to include state laws, federal laws, executive orders, policies, regulations, standards, and guidance.

Standards and Regulations that Apply to this Contract:

Based on data types that are accessed, created, disclosed, received, transmitted, maintained, or stored within Information System(s) of this contract the following standards and regulations apply:

Texas HHS Requirements:

The contractor is responsible for implementing the High security baseline with appropriate controls to protect confidential, agency sensitive, and public information types found in the IS-Controls and the following Texas HHS standards and regulations:

• Information Security Controls (IS-Controls)

• Information Security Risk Assessment Monitoring Process (IS-

RAMP)-

• Updated TX RAMP from DIR website

• Texas Risk and Authorization Management Program (TX-RAMP) | Texas Department of Information Resources

• Security and Privacy Inquiry (SPI) https://dir.texas.gov/information-security/texas-risk-and-authorization-management-program-tx-ramp https://dir.texas.gov/information-security/texas-risk-and-authorization-management-program-tx-ramp

RFP HHS0017023 pg. 2

State and Federal Requirements:

The contractor is additionally responsible for implementing following state and federal standards and regulations:

• Texas Department of Information Resources (DIR) Security Control Standards Catalog

Contract Monitoring:

Contractors are required to fulfill HHS monitoring requirements for continuing compliance as outlined in the IS-RAMP.

Required Information Security & Privacy Controls that Apply to this Contract:

Table 1 below is a list of required security controls mandated by the applicable state and federal regulations listed above. The contractor is required to implement the following list of Information Security and Privacy controls unless there exists a documented agreement that establishes Texas Health and Human Services as the provider for a specified control(s).

Additionally, the contractor is required to implement any additional controls added or modified in subsequent updates to applicable standards and regulations.

If more than one applicable Standard and/or Regulation requires the same Information Security and Privacy control, then the contractor must implement the most restrictive requirements for the specified control.

RFP HHS0017023 pg. 3

Table 1: Information Security & Privacy Controls Minimum Baseline that apply to this Contract Control Number

Control Name

AC-01 Access Control Policy and Procedures AC-02(01) Account Management | Automated System Account Management AC-02(02) Account Management | Automated Temporary and Emergency Account

Management AC-02(03) Account Management | Disable Accounts AC-02(04) Account Management | Automated Audit Actions AC-02(05) Account Management | Inactivity Logout AC-02(09) Account Management | Restrictions on Use of Shared and Group Accounts AC-02(11) Account Management | Usage Conditions AC-02(12) Account Management | Account Monitoring for Atypical Usage AC-02(13) Account Management | Disable Accounts for High-risk Individuals AC-02 Account Management AC-03 Access Enforcement AC-04(04) Information Flow Enforcement | Flow Control of Encrypted Information AC-04 Information Flow Enforcement AC-05 Separation of Duties AC-06(01) Least Privilege | Authorize Access to Security Functions AC-06(02) Least Privilege | Non-privileged Access for Nonsecurity Functions AC-06(03) Least Privilege | Network Access to Privileged Commands AC-06(05) Least Privilege | Privileged Accounts AC-06(07) Least Privilege | Review of User Privileges AC-06(09) Least Privilege | Log Use of Privileged Functions AC-06(10) Least Privilege | Prohibit Non-privileged Users from Executing Privileged

Functions AC-06 Least Privilege AC-07 Unsuccessful Logon Attempts AC-08 System Use Notification AC-10 Concurrent Session Control AC-11(01) Device Lock | Pattern-hiding Displays AC-11 Device Lock AC-12 Session Termination AC-14 Permitted Actions Without Identification or Authentication AC-17(01) Remote Access | Monitoring and Control AC-17(02) Remote Access | Protection of Confidentiality and Integrity Using Encryption AC-17(03) Remote Access | Managed Access Control Points

RFP HHS0017023 pg. 4

AC-17(04) Remote Access | Privileged Commands and Access AC-17 Remote Access AC-18(01) Wireless Access | Authentication and Encryption AC-18(03) Wireless Access | Disable Wireless Networking AC-18(04) Wireless Access | Restrict Configurations by Users AC-18(05) Wireless Access | Antennas and Transmission Power Levels AC-18 Wireless Access AC-19(05) Access Control for Mobile Devices | Full Device or Container-based Encryption AC-19 Access Control for Mobile Devices AC-20(01) Use of External Systems | Limits on Authorized Use AC-20(02) Use of External Systems | Portable Storage Devices — Restricted Use AC-20 Use of External Systems AC-21 Information Sharing AC-22 Publicly Accessible Content AT-01 Awareness and Training Policy and Procedures AT-02(02) Literacy Training and Awareness | Insider Threat AT-02(03) Literacy Training and Awareness | Social Engineering and Mining AT-02 Literacy Training and Awareness AT-03 Role-based Training AT-04 Training Records AU-01 Audit and Accountability Policy and Procedures AU-02 Event Logging AU-03(01) Content of Audit Records | Additional Audit Information AU-03 Content of Audit Records AU-04 Audit Log Storage Capacity AU-05(01) Response to Audit Logging Process Failures | Storage Capacity Warning AU-05(02) Response to Audit Logging Process Failures | Real-time Alerts AU-05 Response to Audit Logging Process Failures AU-06(01) Audit Record Review, Analysis, and Reporting | Automated Process Integration AU-06(03) Audit Record Review, Analysis, and Reporting | Correlate Audit Record

Repositories AU-06(05) Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit

Records AU-06(06) Audit Record Review, Analysis, and Reporting | Correlation with Physical

Monitoring AU-06 Audit Record Review, Analysis, and Reporting AU-07(01) Audit Record Reduction and Report Generation | Automatic Processing AU-07 Audit Record Reduction and Report Generation AU-08 Time Stamps AU-09(02) Protection of Audit Information | Store on Separate Physical Systems or

Components AU-09(03) Protection of Audit Information | Cryptographic Protection

RFP HHS0017023 pg. 5

AU-09(04) Protection of Audit Information | Access by Subset of Privileged Users AU-09 Protection of Audit Information AU-10 Non-repudiation AU-11 Audit Record Retention AU-12(01) Audit Record Generation | System-wide and Time-correlated Audit Trail AU-12(03) Audit Record Generation | Changes by Authorized Individuals AU-12 Audit Record Generation CA-01 Assessment, Authorization, and Monitoring Policy and Procedures CA-02(01) Control Assessments | Independent Assessors CA-02(02) Control Assessments | Specialized Assessments CA-02 Control Assessments CA-03(06) Information Exchange | Transfer Authorizations CA-03 Information Exchange CA-05 Plan of Action and Milestones CA-06 Authorization CA-07(01) Continuous Monitoring | Independent Assessment CA-07(04) Continuous Monitoring | Risk Monitoring CA-07 Continuous Monitoring CA-08(01) Penetration Testing | Independent Penetration Testing Agent or Team CA-08 Penetration Testing CA-09 Internal System Connections CM-01 Configuration Management Policy and Procedures CM-02(02) Baseline Configuration | Automation Support for Accuracy and Currency CM-02(03) Baseline Configuration | Retention of Previous Configurations CM-02(07) Baseline Configuration | Configure Systems and Components for High-risk

Areas CM-02 Baseline Configuration CM-03(01) Configuration Change Control | Automated Documentation, Notification, and

Prohibition of Changes CM-03(02) Configuration Change Control | Testing, Validation, and Documentation of

Changes CM-03(04) Configuration Change Control | Security and Privacy Representatives CM-03(06) Configuration Change Control | Cryptography Management CM-03 Configuration Change Control CM-04(01) Impact Analyses | Separate Test Environments CM-04(02) Impact Analyses | Verification of Controls CM-04 Impact Analyses CM-05(01) Access Restrictions for Change | Automated Access Enforcement and Audit

Records CM-05 Access Restrictions for Change CM-06(01) Configuration Settings | Automated Management, Application, and

Verification

RFP HHS0017023 pg. 6

CM-06(02) Configuration Settings | Respond to Unauthorized Changes CM-06 Configuration Settings CM-07(01) Least Functionality | Periodic Review CM-07(02) Least Functionality | Prevent Program Execution CM-07(05) Least Functionality | Authorized Software — Allow-by-exception CM-07 Least Functionality CM-08(01) System Component Inventory | Updates During Installation and Removal CM-08(02) System Component Inventory | Automated Maintenance CM-08(03) System Component Inventory | Automated Unauthorized Component

Detection CM-08(04) System Component Inventory | Accountability Information CM-08 System Component Inventory CM-09 Configuration Management Plan CM-10 Software Usage Restrictions CM-11 User-installed Software CM-12(01) Information Location | Automated Tools to Support Information Location CM-12 Information Location CP-01 Contingency Planning Policy and Procedures CP-02(01) Contingency Plan | Coordinate with Related Plans CP-02(02) Contingency Plan | Capacity Planning CP-02(03) Contingency Plan | Resume Mission and Business Functions CP-02(05) Contingency Plan | Continue Mission and Business Functions CP-02(08) Contingency Plan | Identify Critical Assets CP-02 Contingency Plan CP-03(01) Contingency Training | Simulated Events CP-03 Contingency Training CP-04(01) Contingency Plan Testing | Coordinate with Related Plans CP-04(02) Contingency Plan Testing | Alternate Processing Site CP-04 Contingency Plan Testing CP-06(01) Alternate Storage Site | Separation from Primary Site CP-06(02) Alternate Storage Site | Recovery Time and Recovery Point Objectives CP-06(03) Alternate Storage Site | Accessibility CP-06 Alternate Storage Site CP-07(01) Alternate Processing Site | Separation from Primary Site CP-07(02) Alternate Processing Site | Accessibility CP-07(03) Alternate Processing Site | Priority of Service CP-07(04) Alternate Processing Site | Preparation for Use CP-07 Alternate Processing Site CP-08(01) Telecommunications Services | Priority of Service Provisions CP-08(02) Telecommunications Services | Single Points of Failure CP-08(03) Telecommunications Services | Separation of Primary and Alternate Providers

RFP HHS0017023 pg. 7

CP-08(04) Telecommunications Services | Provider Contingency Plan CP-08 Telecommunications Services CP-09(01) System Backup | Testing for Reliability and Integrity CP-09(02) System Backup | Test Restoration Using Sampling CP-09(03) System Backup | Separate Storage for Critical Information CP-09(05) System Backup | Transfer to Alternate Storage Site CP-09(08) System Backup | Cryptographic Protection CP-09 System Backup CP-10(02) System Recovery and Reconstitution | Transaction Recovery CP-10(04) System Recovery and Reconstitution | Restore Within Time Period CP-10 System Recovery and Reconstitution CP-11 Alternate Communications Protocols IA-01 Identification and Authentication Policy and Procedures IA-02(01) Identification and Authentication (organizational Users) | Multi-factor

Authentication to Privileged Accounts IA-02(02) Identification and Authentication (organizational Users) | Multi-factor

Authentication to Non-privileged Accounts IA-02(05) Identification and Authentication (organizational Users) | Individual

Authentication with Group Authentication IA-02(08) Identification and Authentication (organizational Users) | Access to Accounts

— Replay Resistant IA-02(12) Identification and Authentication (organizational Users) | Acceptance of PIV

Credentials IA-02 Identification and Authentication (organizational Users) IA-03 Device Identification and Authentication IA-04(04) Identifier Management | Identify User Status IA-04 Identifier Management IA-05(01) Authenticator Management | Password-based Authentication IA-05(02) Authenticator Management | Public Key-based Authentication IA-05(06) Authenticator Management | Protection of Authenticators IA-05(07) Authenticator Management | No Embedded Unencrypted Static

Authenticators IA-05 Authenticator Management IA-06 Authentication Feedback IA-07 Cryptographic Module Authentication IA-08(01) Identification and Authentication (non-organizational Users) | Acceptance of

PIV Credentials from Other Agencies IA-08(02) Identification and Authentication (non-organizational Users) | Acceptance of

External Authenticators IA-08(04) Identification and Authentication (non-organizational Users) | Use of Defined

Profiles IA-08 Identification and Authentication (non-organizational Users) IA-11 Re-authentication

RFP HHS0017023 pg. 8

IA-12(02) Identity Proofing | Identity Evidence IA-12(03) Identity Proofing | Identity Evidence Validation and Verification IA-12(04) Identity Proofing | In-person Validation and Verification IA-12(05) Identity Proofing | Address Confirmation IA-12 Identity Proofing IR-01 Incident Response Policy and Procedures IR-02(01) Incident Response Training | Simulated Events IR-02(02) Incident Response Training | Automated Training Environments IR-02 Incident Response Training IR-03(02) Incident Response Testing | Coordination with Related Plans IR-03 Incident Response Testing IR-04(01) Incident Handling | Automated Incident Handling Processes IR-04(04) Incident Handling | Information Correlation IR-04(11) Incident Handling | Integrated Incident Response Team IR-04 Incident Handling IR-05(01) Incident Monitoring | Automated Tracking, Data Collection, and Analysis IR-05 Incident Monitoring IR-06(01) Incident Reporting | Automated Reporting IR-06(03) Incident Reporting | Supply Chain Coordination IR-06 Incident Reporting IR-07(01) Incident Response Assistance | Automation Support for Availability of

Information and Support IR-07 Incident Response Assistance IR-08 Incident Response Plan IR-09 Information Spillage Response MA-01 Maintenance Policy and Procedures MA-02(02) Controlled Maintenance | Automated Maintenance Activities MA-02 Controlled Maintenance MA-03(01) Maintenance Tools | Inspect Tools MA-03(02) Maintenance Tools | Inspect Media MA-03(03) Maintenance Tools | Prevent Unauthorized Removal MA-03 Maintenance Tools MA-04(03) Nonlocal Maintenance | Comparable Security and Sanitization MA-04 Nonlocal Maintenance MA-05(01) Maintenance Personnel | Individuals Without Appropriate Access MA-05 Maintenance Personnel MA-06 Timely Maintenance MP-01 Media Protection Policy and Procedures MP-02 Media Access MP-03 Media Marking MP-04 Media Storage

RFP HHS0017023 pg. 9

MP-05 Media Transport MP-06(01) Media Sanitization | Review, Approve, Track, Document, and Verify MP-06(02) Media Sanitization | Equipment Testing MP-06(03) Media Sanitization | Nondestructive Techniques MP-06 Media Sanitization MP-07 Media Use PE-01 Physical and Environmental Protection Policy and Procedures PE-02 Physical Access Authorizations PE-03(01) Physical Access Control | System Access PE-03 Physical Access Control PE-04 Access Control for Transmission PE-05 Access Control for Output Devices PE-06(01) Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment PE-06(04) Monitoring Physical Access | Monitoring Physical Access to Systems PE-06 Monitoring Physical Access PE-08(01) Visitor Access Records | Automated Records Maintenance and Review PE-08 Visitor Access Records PE-09 Power Equipment and Cabling PE-10 Emergency Shutoff PE-11(01) Emergency Power | Alternate Power Supply — Minimal Operational Capability PE-11 Emergency Power PE-12 Emergency Lighting PE-13(01) Fire Protection | Detection Systems — Automatic Activation and Notification PE-13(02) Fire Protection | Suppression Systems — Automatic Activation and

Notification PE-13 Fire Protection PE-14 Environmental Controls PE-15(01) Water Damage Protection | Automation Support PE-15 Water Damage Protection PE-16 Delivery and Removal PE-17 Alternate Work Site PE-18 Location of System Components PL-01 Planning Policy and Procedures PL-02 System Security and Privacy Plans PL-04(01) Rules of Behavior | Social Media and External Site/application Usage

Restrictions PL-04 Rules of Behavior PL-08 Security and Privacy Architectures PL-10 Baseline Selection PL-11 Baseline Tailoring PM-01 Information Security Program Plan PM-02 Information Security Program Leadership Role

RFP HHS0017023 pg. 10

PM-03 Information Security and Privacy Resources PM-04 Plan of Action and Milestones Process PM-05 System Inventory PM-06 Measures of Performance PM-07 Enterprise Architecture PM-09 Risk Management Strategy PM-10 Authorization Process PM-14 Testing, Training, and Monitoring PM-15 Security and Privacy Groups and Associations PM-16 Threat Awareness Program PS-01 Personnel Security Policy and Procedures PS-02 Position Risk Designation PS-03 Personnel Screening PS-04(02) Personnel Termination | Automated Actions PS-04 Personnel Termination PS-05 Personnel Transfer PS-06 Access Agreements PS-07 External Personnel Security PS-08 Personnel Sanctions PS-09 Position Descriptions RA-01 Risk Assessment Policy and Procedures RA-02 Security Categorization RA-03(01) Risk Assessment | Supply Chain Risk Assessment RA-03 Risk Assessment RA-05(02) Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be Scanned RA-05(04) Vulnerability Monitoring and Scanning | Discoverable Information RA-05(05) Vulnerability Monitoring and Scanning | Privileged Access RA-05(11) Vulnerability Monitoring and Scanning | Public Disclosure Program RA-05 Vulnerability Monitoring and Scanning RA-07 Risk Response RA-09 Criticality Analysis SA-01 System and Services Acquisition Policy and Procedures SA-02 Allocation of Resources SA-03 System Development Life Cycle SA-04(01) Acquisition Process | Functional Properties of Controls SA-04(02) Acquisition Process | Design and Implementation Information for Controls SA-04(05) Acquisition Process | System, Component, and Service Configurations SA-04(09) Acquisition Process | Functions, Ports, Protocols, and Services in Use SA-04(10) Acquisition Process | Use of Approved PIV Products SA-04 Acquisition Process SA-05 System Documentation

RFP HHS0017023 pg. 11

SA-08 Security and Privacy Engineering Principles SA-09(02) External System Services | Identification of Functions, Ports, Protocols, and

Services SA-09 External System Services SA-10 Developer Configuration Management SA-11(01) Developer Testing and Evaluation | Static Code Analysis SA-11(02) Developer Testing and Evaluation | Threat Modeling and Vulnerability

Analyses SA-11(05) Developer Testing and Evaluation | Penetration Testing SA-11(08) Developer Testing and Evaluation | Dynamic Code Analysis SA-11 Developer Testing and Evaluation SA-15(03) Development Process, Standards, and Tools | Criticality Analysis SA-15 Development Process, Standards, and Tools SA-16 Developer-provided Training SA-17 Developer Security and Privacy Architecture and Design SA-21 Developer Screening SA-22 Unsupported System Components SC-01 System and Communications Protection Policy and Procedures SC-02 Separation of System and User Functionality SC-03 Security Function Isolation SC-04 Information in Shared System Resources SC-05 Denial-of-service Protection SC-07(03) Boundary Protection | Access Points SC-07(04) Boundary Protection | External Telecommunications Services SC-07(05) Boundary Protection | Deny by Default — Allow by Exception SC-07(07) Boundary Protection | Split Tunneling for Remote Devices SC-07(08) Boundary Protection | Route Traffic to Authenticated Proxy Servers SC-07(18) Boundary Protection | Fail Secure SC-07(21) Boundary Protection | Isolation of System Components SC-07 Boundary Protection SC-08(01) Transmission Confidentiality and Integrity | Cryptographic Protection SC-08 Transmission Confidentiality and Integrity SC-10 Network Disconnect SC-12(01) Cryptographic Key Establishment and Management | Availability SC-12 Cryptographic Key Establishment and Management SC-13 Cryptographic Protection SC-15 Collaborative Computing Devices and Applications SC-17 Public Key Infrastructure Certificates SC-18 Mobile Code SC-20 Secure Name/address Resolution Service (authoritative Source) SC-21 Secure Name/address Resolution Service (recursive or Caching Resolver) SC-22 Architecture and Provisioning for Name/address Resolution Service

RFP HHS0017023 pg. 12

SC-23 Session Authenticity SC-24 Fail in Known State SC-28(01) Protection of Information at Rest | Cryptographic Protection SC-28 Protection of Information at Rest SC-39 Process Isolation SI-01 System and Information Integrity Policy and Procedures SI-02(02) Flaw Remediation | Automated Flaw Remediation Status SI-02 Flaw Remediation SI-03 Malicious Code Protection SI-04(02) System Monitoring | Automated Tools and Mechanisms for Real-time Analysis SI-04(04) System Monitoring | Inbound and Outbound Communications Traffic SI-04(05) System Monitoring | System-generated Alerts SI-04(10) System Monitoring | Visibility of Encrypted Communications SI-04(12) System Monitoring | Automated Organization-generated Alerts SI-04(14) System Monitoring | Wireless Intrusion Detection SI-04(20) System Monitoring | Privileged Users SI-04(22) System Monitoring | Unauthorized Network Services SI-04 System Monitoring SI-05(01) Security Alerts, Advisories, and Directives | Automated Alerts and Advisories SI-05 Security Alerts, Advisories, and Directives SI-06 Security and Privacy Function Verification SI-07(01) Software, Firmware, and Information Integrity | Integrity Checks SI-07(02) Software, Firmware, and Information Integrity | Automated Notifications of

Integrity Violations SI-07(05) Software, Firmware, and Information Integrity | Automated Response to

Integrity Violations SI-07(07) Software, Firmware, and Information Integrity | Integration of Detection and

Response SI-07(15) Software, Firmware, and Information Integrity | Code Authentication SI-07 Software, Firmware, and Information Integrity SI-08(02) Spam Protection | Automatic Updates SI-08 Spam Protection SI-10(01) Information Input Validation | Manual Override Capability SI-10(02) Information Input Validation | Review and Resolve Errors SI-10(03) Information Input Validation | Predictable Behavior SI-10(04) Information Input Validation | Timing Interactions SI-10(05) Information Input Validation | Restrict Inputs to Trusted Sources and

Approved Formats SI-10(06) Information Input Validation | Injection Prevention SI-10 Information Input Validation SI-11 Error Handling SI-12 Information Management and Retention

RFP HHS0017023 pg. 13

SI-16 Memory Protection SR-01 Supply Chain Risk Management Policy and Procedures SR-02(01) Supply Chain Risk Management Plan | Establish SCRM Team SR-02 Supply Chain Risk Management Plan SR-03 Supply Chain Controls and Processes SR-05 Acquisition Strategies, Tools, and Methods SR-06 Supplier Assessments and Reviews SR-08 Notification Agreements SR-09(01) Tamper Resistance and Detection | Multiple Stages of System Development

Life Cycle SR-09 Tamper Resistance and Detection SR-10 Inspection of Systems or Components SR-11(01) Component Authenticity | Anti-counterfeit Training SR-11(02) Component Authenticity | Configuration Control for Component Service and

Repair SR-11 Component Authenticity SR-12 Component Disposal