The file's text, extracted by GovTribe without its formatting.
ATTACHMENT F
RISK MANAGEMENT TERMS
The following terms are issued by EOTSS’ Office of Enterprise Risk Management and shall apply to Cloud Solutions, which may include software and services, purchased by the Commonwealth. The Office of Enterprise Risk Management is issuing the following terms to improve the cyber security posture of the Commonwealth and to ensure adequate risk management controls are implemented by the Commonwealth’s contractors.
Vendor (or “Cloud Solution Provider”) must provide a response indicating the manner in which the proposed Cloud Solutions meet each term, or provide justification as to why a term is not applicable to the offered services. These terms may be negotiated between the Commonwealth and the vendor and shall take precedence over any conflicting terms provided by the vendor. Any questions regarding the following terms or the sufficiency of the responses should be directed to the Office of Enterprise Risk Management, ERM@mass.gov. To fulfill this requirement, the cloud service provider may share a copy of any recent systems audits (SOC2, PCI-DSS, etc.) completed by third-party service providers in lieu of completing the assessment.
Vendor Name:
Contact Info: Name:_____________________________Email:______________________
| Category |
| Term |
| Vendor’s Response |
| Risk Management |
| Cloud Solution Provider shall perform annual penetration testing of its application and/or system and shall remediate the vulnerabilities and confirm that corrective measures have been implemented in a manner that prevents exploitation identified during the penetration testing. |
| Risk Management |
| Cloud Solution Provider shall establish a program to develop and maintain an incident response capability to prepare, detect and immediately respond to an attack. |
| Risk Management |
| Cloud Solution Provider shall manage the security life cycle of any application and/or system it has developed, acquired or is hosting, to prevent, detect and remediate security weaknesses before they can impact the Agency. |
| Risk Management |
| Cloud Solution Provider will evaluate subcontractors and other service providers who will hold Agency data to ensure that such subcontractors and providers are protecting the Agency data in accordance with Cloud Solution Provider’s obligations to Agency. |
| Risk Management |
| Cloud Solution Provider shall maintain a security awareness program to influence behavior among its workforce to be security conscious and properly skilled to reduce cybersecurity risks to the Cloud Solution Provider. |
| Risk Management |
| Cloud Solution Provider shall operate processes and tooling to establish and maintain comprehensive network monitoring of its assets and defense against security threats across its applications and systems. |
| Risk Management |
| Cloud Solution Provider shall establish, implement, and actively manage (monitor, track, report and correct) its network devices in order to prevent attacks from exploiting any vulnerabilities in its network services and access points. |
| Risk Management |
| Cloud Solution Provider will establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-incident and trusted state. |
| Risk Management |
| Cloud Solution Provider shall review and test the disaster recovery plan regularly, at minimum twice annually. Cloud Solution Provider shall back up Agency Data in an off-site “hardened” facility located within the United States. In the event of service failure, Cloud Solution Provider shall be able to restore the Cloud Solution, including Agency Data, with loss of no more than twelve (12) hours of Agency Data and transactions prior to failure. |
| Risk Management |
| Cloud Solution Provider shall actively work on improving protections and detections of threats from email and web actors trying to manipulate human behavior through direct engagement. |
| Risk Management |
| Cloud Solution Provider shall collect, alert, review and retain audit logs of events that may help detect, understand or recover from an attack. |
| Risk Management |
| Cloud Solution Provider shall have a plan to continuously assess and track vulnerabilities of its assets within its infrastructure. |
| Risk Management |
| Cloud Solution Provider shall use processes and tools to create, assign, manage and revoke access credentials and privileges for user, administrator, and service accounts for its assets and software. |
| Risk Management |
| Cloud Solution Provider will use processes and tools to ensure that access to the Cloud Solution is restricted to users with the correct credentials for the applicable user accounts. |
| Risk Management |
| Cloud Solution Provider shall establish and maintain a secure configuration of its assets and software. |
| Risk Management |
| Cloud Solution Provider will develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data. |
| Risk Management |
| Cloud Solution Provider shall actively manage, through inventorying, tracking and correcting, all of its assets connected to its infrastructure physically, virtually, remotely and those within its cloud environments to accurately know the totality of its assets that need to be monitored and protected. |
| Risk Management |
| Cloud Solution Provider shall actively manage, through inventorying, tracking and correcting, all software on its network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution. |
| Risk Management |
| Cloud Solution Provider shall provide Agency with access to a console or other mechanism for tracking entitlements and deployments of the Solution within Agency’s environment. Cloud Solution Provider will enable Agency to centrally manage updates or upgrades to all deployments from the console. |
| Risk Management |
| Cloud Solution Provider shall implement Multi Factor Authentication (MFA) for remote and admin access. |
| Risk Management |
| Cloud Solution Provider shall promptly replace end of life systems and applications. |