Exhibit Q, HHS Information Security and Privacy Requirements.pdf

Texas Health and Human Services Information Security and Privacy Requirements

STANDARDS AND REGULATIONS:

Contractors are required to comply with HHS Information Security and Privacy requirements to maintain a business relationship with Texas HHS. Accordingly, contractors are required to adhere to all applicable standards and regulations (and their associated security controls) to include state laws, federal laws, executive orders, policies, regulations, standards, and guidance.

STANDARDS AND REGULATIONS THAT APPLY TO THIS CONTRACT:

Based on data types that are accessed, created, disclosed, received, transmitted, maintained, or stored within Information System(s) of this contract the following standards and regulations apply:

TEXAS HHS REQUIREMENTS:

The contractor is responsible for implementing the HHS (NIST SP 800-53R5 equivalent) security baseline and the DIR overlays found in the IS-Controls and the following Texas HHS standards and regulations:

• Information Security Controls (IS-Controls)

• Information Security Risk Management Policy

• Security and Privacy Inquiry (SPI)

• Information Security Acceptable Use Policy

STATE AND FEDERAL REQUIREMENTS:

The contractor is additionally responsible for implementing following state and federal standards and regulations:

• Texas Department of Information Resources (DIR) Security Control Standards Catalog

• Texas Risk and Authorization Management Program (TX-RAMP)

• TX-RAMP Security Controls Baselines

• Texas Administrative Coded (TAC) 202

• Texas Government Code (TGC) 2054

• Texas Cybersecurity Framework Controls (TCSF) and Definitions

• NIST Special Publication 800-53 (Rev. 5) Security and Privacy Controls for

Information Systems and Organizations

CONTRACT MONITORING:

Contractors are required to fulfill HHS monitoring requirements for continuing compliance as outlined in the Information Security Risk Management Policy.

REQUIRED INFORMATION SECURITY & PRIVACY CONTROLS THAT

APPLY TO THIS CONTRACT:

RFP No. HHS0016867 Exhibit Q

Table 1 Below is a list of required security controls mandated by the applicable state and federal regulations listed above. The contractor must implement the following list of Information Security and Privacy controls unless there is a documented agreement establishing Texas Health and Human Services as the provider for a specified control(s).

Also, the contractor must implement any additional controls added or modified in subsequent updates to applicable standards and regulations.

If more than one applicable Standard and Regulation requires the same Information Security and Privacy control, then the contractor must implement the most restrictive requirements for the specified control.

Table 1: Information Security & Privacy Controls Minimum Baseline that applies to this Contract.

Control ID Control Name AC-01 Policy and Procedures

AC-02 Account Management

AC-02(01) Account Management | Automated System Account Management

AC-02(02) Account Management | Automated Temporary and Emergency Account Management

AC-02(03) Account Management | Disable Accounts

AC-02(04) Account Management | Automated Audit Actions

AC-02(05) Account Management | Inactivity Logout

AC-02(13) Account Management | Disable Accounts for High-risk Individuals

AC-03 Access Enforcement

AC-04 Information Flow Enforcement

AC-05 Separation of Duties

AC-06 Least Privilege

AC-06(01) Least Privilege | Authorize Access to Security Functions

AC-06(02) Least Privilege | Non-privileged Access for Nonsecurity Functions

AC-06(05) Least Privilege | Privileged Accounts

AC-06(07) Least Privilege | Review of User Privileges

AC-06(09) Least Privilege | Log Use of Privileged Functions

AC-06(10) Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions

AC-07 Unsuccessful Logon Attempts

AC-08 System Use Notification

AC-11 Device Lock

AC-11(01) Device Lock | Pattern-hiding Displays

AC-12 Session Termination

AC-14 Permitted Actions Without Identification or Authentication

AC-17 Remote Access

AC-17(01) Remote Access | Monitoring and Control

AC-17(02) Remote Access | Protection of Confidentiality and Integrity Using Encryption

AC-17(03) Remote Access | Managed Access Control Points

AC-17(04) Remote Access | Privileged Commands and Access

AC-18 Wireless Access

AC-18(01) Wireless Access | Authentication and Encryption

AC-18(03) Wireless Access | Disable Wireless Networking

AC-19 Access Control for Mobile Devices

AC-19(05) Access Control for Mobile Devices | Full Device or Container-based Encryption

AC-20 Use of External Systems

AC-20(01) Use of External Systems | Limits on Authorized Use

AC-20(02) Use of External Systems | Portable Storage Devices — Restricted Use

AC-21 Information Sharing

AC-22 Publicly Accessible Content

AT-01 Policy and Procedures

AT-02 Literacy Training and Awareness

AT-02(02) Literacy Training and Awareness | Insider Threat

AT-02(03) Literacy Training and Awareness | Social Engineering and Mining

AT-03 Role-based Training

AT-04 Training Records

AU-01 Policy and Procedures

AU-02 Event Logging

AU-03 Content of Audit Records

AU-03(01) Content of Audit Records | Additional Audit Information

AU-04 Audit Log Storage Capacity

AU-05 Response to Audit Logging Process Failures

AU-06 Audit Record Review, Analysis, and Reporting

AU-06(01) Audit Record Review, Analysis, and Reporting | Automated Process Integration

AU-06(03) Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories

AU-07 Audit Record Reduction and Report Generation

AU-07(01) Audit Record Reduction and Report Generation | Automatic Processing

AU-08 Time Stamps

AU-09 Protection of Audit Information

AU-09(04) Protection of Audit Information | Access by Subset of Privileged Users

AU-11 Audit Record Retention

AU-12 Audit Record Generation

CA-01 Policy and Procedures

CA-02 Control Assessments

CA-02(01) Control Assessments | Independent Assessors

CA-03 Information Exchange

CA-05 Plan of Action and Milestones

CA-06 Authorization

CA-07 Continuous Monitoring

CA-07(01) Continuous Monitoring | Independent Assessment

CA-07(04) Continuous Monitoring | Risk Monitoring

CA-08 Penetration Testing

CA-09 Internal System Connections

CM-01 Policy and Procedures

CM-02 Baseline Configuration

CM-02(02) Baseline Configuration | Automation Support for Accuracy and Currency

CM-02(03) Baseline Configuration | Retention of Previous Configurations

CM-02(07) Baseline Configuration | Configure Systems and Components for High-risk Areas

CM-03 Configuration Change Control

CM-03(02) Configuration Change Control | Testing, Validation, and Documentation of Changes

CM-03(04) Configuration Change Control | Security and Privacy Representatives

CM-04 Impact Analyses

CM-04(02) Impact Analyses | Verification of Controls

CM-05 Access Restrictions for Change

CM-06 Configuration Settings

CM-07 Least Functionality

CM-07(01) Least Functionality | Periodic Review

CM-07(02) Least Functionality | Prevent Program Execution

CM-07(05) Least Functionality | Authorized Software — Allow-by-exception

CM-08 System Component Inventory

CM-08(01) System Component Inventory | Updates During Installation and Removal

CM-08(03) System Component Inventory | Automated Unauthorized Component Detection

CM-09 Configuration Management Plan

CM-10 Software Usage Restrictions

CM-11 User-installed Software

CM-12 Information Location

CM-12(01) Information Location | Automated Tools to Support Information Location

CP-01 Policy and Procedures

CP-02 Contingency Plan

CP-02(01) Contingency Plan | Coordinate with Related Plans

CP-02(03) Contingency Plan | Resume Mission and Business Functions

CP-02(08) Contingency Plan | Identify Critical Assets

CP-03 Contingency Training

CP-04 Contingency Plan Testing

CP-04(01) Contingency Plan Testing | Coordinate with Related Plans

CP-06 Alternate Storage Site

CP-06(01) Alternate Storage Site | Separation from Primary Site

CP-06(03) Alternate Storage Site | Accessibility

CP-07 Alternate Processing Site

CP-07(01) Alternate Processing Site | Separation from Primary Site

CP-07(02) Alternate Processing Site | Accessibility

CP-07(03) Alternate Processing Site | Priority of Service

CP-08 Telecommunications Services

CP-08(01) Telecommunications Services | Priority of Service Provisions

CP-08(02) Telecommunications Services | Single Points of Failure

CP-09 System Backup

CP-09(01) System Backup | Testing for Reliability and Integrity

CP-09(08) System Backup | Cryptographic Protection

CP-10 System Recovery and Reconstitution

CP-10(02) System Recovery and Reconstitution | Transaction Recovery

CP-11 Alternate Communications Protocols

IA-01 Policy and Procedures

IA-02 Identification and Authentication (organizational Users)

IA-02(01) Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts

IA-02(02) Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged Accounts

IA-02(08) Identification and Authentication (organizational Users) | Access to Accounts — Replay Resistant

IA-02(12) Identification and Authentication (organizational Users) | Acceptance of PIV Credentials

IA-03 Device Identification and Authentication

IA-04 Identifier Management

IA-04(04) Identifier Management | Identify User Status

IA-05 Authenticator Management

IA-05(01) Authenticator Management | Password-based Authentication

IA-05(02) Authenticator Management | Public Key-based Authentication

IA-05(06) Authenticator Management | Protection of Authenticators

IA-05(07) Authenticator Management | No Embedded Unencrypted Static Authenticators

IA-06 Authentication Feedback

IA-07 Cryptographic Module Authentication

IA-08 Identification and Authentication (non-organizational Users)

IA-08(01) Identification and Authentication (non-organizational Users) | Acceptance of PIV Credentials from Other Agencies

IA-08(02) Identification and Authentication (non-organizational Users) | Acceptance of External Authenticators

IA-08(04) Identification and Authentication (non-organizational Users) | Use of Defined Profiles

IA-11 Re-authentication

IA-12 Identity Proofing

IA-12(02) Identity Proofing | Identity Evidence

IA-12(03) Identity Proofing | Identity Evidence Validation and Verification

IA-12(05) Identity Proofing | Address Confirmation

IR-01 Policy and Procedures

IR-02 Incident Response Training

IR-03 Incident Response Testing

IR-03(02) Incident Response Testing | Coordination with Related Plans

IR-04 Incident Handling

IR-04(01) Incident Handling | Automated Incident Handling Processes

IR-05 Incident Monitoring

IR-06 Incident Reporting

IR-06(01) Incident Reporting | Automated Reporting

IR-06(03) Incident Reporting | Supply Chain Coordination

IR-07 Incident Response Assistance

IR-07(01) Incident Response Assistance | Automation Support for Availability of Information and Support

IR-08 Incident Response Plan

IR-09 Information Spillage Response

MA-01 Policy and Procedures

MA-02 Controlled Maintenance

MA-03 Maintenance Tools

MA-03(01) Maintenance Tools | Inspect Tools

MA-03(02) Maintenance Tools | Inspect Media

MA-03(03) Maintenance Tools | Prevent Unauthorized Removal

MA-04 Nonlocal Maintenance

MA-05 Maintenance Personnel

MA-06 Timely Maintenance

MP-01 Policy and Procedures

MP-02 Media Access

MP-03 Media Marking

MP-04 Media Storage

MP-05 Media Transport

MP-06 Media Sanitization

MP-06(01) Media Sanitization | Review, Approve, Track, Document, and Verify

MP-07 Media Use

PE-01 Policy and Procedures

PE-02 Physical Access Authorizations

PE-03 Physical Access Control

PE-04 Access Control for Transmission

PE-05 Access Control for Output Devices

PE-06 Monitoring Physical Access

PE-06(01) Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment

PE-08 Visitor Access Records

PE-09 Power Equipment and Cabling

PE-10 Emergency Shutoff

PE-11 Emergency Power

PE-12 Emergency Lighting

PE-13 Fire Protection

PE-13(01) Fire Protection | Detection Systems — Automatic Activation and Notification

PE-14 Environmental Controls

PE-15 Water Damage Protection

PE-16 Delivery and Removal

PE-17 Alternate Work Site

PL-01 Policy and Procedures

PL-02 System Security and Privacy Plans

PL-04 Rules of Behavior

PL-04(01) Rules of Behavior | Social Media and External Site/application Usage Restrictions

PL-08 Security and Privacy Architectures

PL-10 Baseline Selection

PL-11 Baseline Tailoring

PM-01 Information Security Program Plan

PM-02 Information Security Program Leadership Role

PM-03 Information Security and Privacy Resources

PM-04 Plan of Action and Milestones Process

PM-05 System Inventory

PM-06 Measures of Performance

PM-07 Enterprise Architecture

PM-09 Risk Management Strategy

PM-10 Authorization Process

PM-14 Testing, Training, and Monitoring

PM-15 Security and Privacy Groups and Associations

PM-16 Threat Awareness Program

PS-01 Policy and Procedures

PS-02 Position Risk Designation

PS-03 Personnel Screening

PS-04 Personnel Termination

PS-05 Personnel Transfer

PS-06 Access Agreements

PS-07 External Personnel Security

PS-08 Personnel Sanctions

PS-09 Position Descriptions

RA-01 Policy and Procedures

RA-02 Security Categorization

RA-03 Risk Assessment

RA-03(01) Risk Assessment | Supply Chain Risk Assessment

RA-05 Vulnerability Monitoring and Scanning

RA-05(02) Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be Scanned

RA-05(05) Vulnerability Monitoring and Scanning | Privileged Access

RA-05(11) Vulnerability Monitoring and Scanning | Public Disclosure Program

RA-07 Risk Response

RA-09 Criticality Analysis

SA-01 Policy and Procedures

SA-02 Allocation of Resources

SA-03 System Development Life Cycle

SA-04 Acquisition Process

SA-04(01) Acquisition Process | Functional Properties of Controls

SA-04(02) Acquisition Process | Design and Implementation Information for Controls

SA-04(09) Acquisition Process | Functions, Ports, Protocols, and Services in Use

SA-04(10) Acquisition Process | Use of Approved PIV Products

SA-05 System Documentation

SA-08 Security and Privacy Engineering Principles

SA-09 External System Services

SA-09(02) External System Services | Identification of Functions, Ports, Protocols, and Services

SA-10 Developer Configuration Management

SA-11 Developer Testing and Evaluation

SA-11(01) Developer Testing and Evaluation | Static Code Analysis

SA-11(02) Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses

SA-11(05) Developer Testing and Evaluation | Penetration Testing

SA-11(08) Developer Testing and Evaluation | Dynamic Code Analysis

SA-15 Development Process, Standards, and Tools

SA-15(03) Development Process, Standards, and Tools | Criticality Analysis

SA-22 Unsupported System Components

SC-01 Policy and Procedures

SC-02 Separation of System and User Functionality

SC-04 Information in Shared System Resources

SC-05 Denial-of-service Protection

SC-07 Boundary Protection

SC-07(03) Boundary Protection | Access Points

SC-07(04) Boundary Protection | External Telecommunications Services

SC-07(05) Boundary Protection | Deny by Default — Allow by Exception

SC-07(07) Boundary Protection | Split Tunneling for Remote Devices

SC-07(08) Boundary Protection | Route Traffic to Authenticated Proxy Servers

SC-08 Transmission Confidentiality and Integrity

SC-08(01) Transmission Confidentiality and Integrity | Cryptographic Protection

SC-10 Network Disconnect

SC-12 Cryptographic Key Establishment and Management

SC-13 Cryptographic Protection

SC-15 Collaborative Computing Devices and Applications

SC-17 Public Key Infrastructure Certificates

SC-18 Mobile Code

SC-20 Secure Name/address Resolution Service (authoritative Source)

SC-21 Secure Name/address Resolution Service (recursive or Caching Resolver)

SC-22 Architecture and Provisioning for Name/address Resolution Service

SC-23 Session Authenticity

SC-28 Protection of Information at Rest

SC-28(01) Protection of Information at Rest | Cryptographic Protection

SC-39 Process Isolation

SI-01 Policy and Procedures

SI-02 Flaw Remediation

SI-02(02) Flaw Remediation | Automated Flaw Remediation Status

SI-03 Malicious Code Protection

SI-04 System Monitoring

SI-04(02) System Monitoring | Automated Tools and Mechanisms for Real-time Analysis

SI-04(04) System Monitoring | Inbound and Outbound Communications Traffic

SI-04(05) System Monitoring | System-generated Alerts

SI-05 Security Alerts, Advisories, and Directives

SI-07 Software, Firmware, and Information Integrity

SI-07(01) Software, Firmware, and Information Integrity | Integrity Checks

SI-07(07) Software, Firmware, and Information Integrity | Integration of Detection and Response

SI-08 Spam Protection

SI-08(02) Spam Protection | Automatic Updates

SI-10 Information Input Validation

SI-10(01) Information Input Validation | Manual Override Capability

SI-10(02) Information Input Validation | Review and Resolve Errors

SI-10(03) Information Input Validation | Predictable Behavior

SI-10(04) Information Input Validation | Timing Interactions

SI-10(05) Information Input Validation | Restrict Inputs to Trusted Sources and Approved Formats

SI-10(06) Information Input Validation | Injection Prevention

SI-11 Error Handling

SI-12 Information Management and Retention

SI-16 Memory Protection

SR-01 Policy and Procedures

SR-02 Supply Chain Risk Management Plan

SR-02(01) Supply Chain Risk Management Plan | Establish SCRM Team

SR-03 Supply Chain Controls and Processes

SR-05 Acquisition Strategies, Tools, and Methods

SR-06 Supplier Assessments and Reviews

SR-08 Notification Agreements

SR-10 Inspection of Systems or Components

SR-11 Component Authenticity

SR-11(01) Component Authenticity | Anti-counterfeit Training

SR-11(02) Component Authenticity | Configuration Control for Component Service and Repair

SR-12 Component Disposal