Host Site Analysis RFQ PERS 2023-05.docx

REQUEST FOR QUOTES (RFQ)

Best Value Analysis Process Host Site Analysis

PERS-RFQ # 2023-05

OregonBuys # S-45900-00007846

Issue Date: August 16, 2023

Issuing Office: Public Employees Retirement System (PERS)

RFQ Contact Information

Offer Due Date and Time: Wednesday, August 30, 2023, 4:00PM PST.

Introduction Authorized Purchaser is issuing this RFQ seeking professional consulting services related to Data Center Host Site Analysis.

Agency Background Information PERS MISSION: We serve the people of Oregon by administering public employee benefit trusts to pay the right person the right benefit at the right time.

PERS was established in 1946 to provide retirement, disability, and death benefits to Oregon’s state, school district, and local government employees. The Agency’s 400 employees serve approximately 228,000 non-retired members, 156,500 retired members or beneficiaries, and 900 public employers. PERS is governed by a five-member board. PERS also administers a deferred compensation plan, known as the Oregon Savings Growth Plan (OSGP), a tax qualified 457 plan. By statute, OSGP is available to all state employees and the employees of those local government units that have chosen to offer OSGP.

RFQ Purpose & Background In 2022, PERS moved their data center from the PERS HQ in Tigard, Oregon to the State Data Center located in Salem, Oregon. The recommendation from the analysis facilitated by the Office of the State CIO was to migrate the data center into a Co-Location instead of Managed Services. Since then, the Office of the State CIO, now referred to as Enterprise Information Services (EIS), have requested PERS to re-evaluate and provide analysis of the costs and risks between Co-Lo, Managed Services and Cloud.

Budget PERS has allocated approximately $80,000 for professional services to complete the analysis.

Definitions

Statement of Work Contractor shall conduct an independent review of the Target-State hosting environment based on:

1. Evaluation of the PERS developed requirements of data center hosting, application resiliency, and IT DR capabilities.

2. Total Cost of Ownership (TCO) for Co-Location and Managed Services at Data Center Services (DCS) and Cloud.

3. Evaluation of three alternatives (Co-Lo, Managed, Cloud) across dimensions such as architectural suitability, operational support, governance, risks, organizational impact and the PERS Modernization Program.

4. Validate findings of alternative analysis with the PERS Team to aide their decision-making process.

5. Understand the impact of a possible move on SB1049 and PERS Modernization programs and projects.

6. Contractor shall use PERS QCP Process (See Attachment #2).

Deliverables and Timelines

Schedule review sessions and workshops

· Requirements for DC hosting

· IT DR and failover requirements

· Operation and application manageability requirements

· Application governance

· Total cost of ownership for three DC hosting alternatives

· PERS organizational structure

· Major Projects in flight and planned – SB1049 and PERS Modernization

- Customize DC hosting alternatives framework with PERS specific weighted criteria for architecture-fit, viability, risk, and operational complexity

- Hold 1-hour session with PERS project team to confirm:

· Alternatives analysis framework and weights

· Viable target-state hosting alternatives

AC1.

Framework document includes all 3 alternatives in consideration for analysis.

AC2.

Framework document includes all relevant areas of consideration for each alternative.

AC3. Framework document lists areas to consider with accurate weighting for each area.

6 business days

· Co-lo environment

· Managed services environment

· Cloud environment

· Inclusion of IT DR Services

· Inclusion of backup and recovery services

- Utilize customized alternatives analysis framework to conduct relative analysis of each alternative

- Consider the impact to SB1049 and PERS Modernization project activities of moving during completion of execution or after execution AC1. Analysis Document includes all relevant areas of consideration.

AC2. Impact Analysis addresses impacts to SB1049 and PERS Modernization programs 10 business days

AC2. Report clearly states an unbiased recommendation of target-state for PERS to consider.

2 business days

AC2. Deck content uses language and references that are understandable by a non-technical audience 1 business day

TOTAL

25 business days

Security Certification As applicable Offer must contain a statement demonstrating Offeror's agreement that if awarded a Contract:

a. Offeror and Offeror's staff with access to State systems, facilities, data, and confidential information will submit to all security checks requested by DAS or Agency, which may include any combination of fingerprinting, Oregon Law Enforcement Data Systems (“LEDS”) and Federal Bureau of Investigation Criminal Justice Information Services (“FBI CJIS”) background checks; and

b. Upon request, Offeror and Offeror’s staff will sign a non-disclosure agreement for any/all data or information received or processed on its equipment from the State of Oregon; and

c. Comply with any applicable PERS Security Policies (see RFQ Attachment # 3)

d. Offeror will protect at all times State of Oregon sensitive material; and

e. Offeror will meet or exceed the State of Oregon’s security standards as set forth in the following:

i. Privileged Access Monitoring and Reporting viewable at: https://www.oregon.gov/das/Policies/107-004-140.pdf

ii. Statewide Information and Cyber Security Standards viewable at: https://www.oregon.gov/das/OSCIO/Documents/2019StatewideInformationAndCyberSecurityStandardsV1.0.pdf

iii. Statewide Cloud Computing policy:

http://www.oregon.gov/das/policies/107-004-150.pdf

Questions and Requests All questions and requests for clarification of this RFQ must be submitted in writing by email to the above listed Authorized Representative, and must be received no later than August 23, 2023, at 4pm PST. When appropriate, as determined by the Authorized Representative in its sole discretion, revisions, substitutions, or clarification of this RFQ will be sent electronically.

RFQ Response Submittal Responses must be received on or before the Offer Due Date and Time. All submissions shall be emailed only to the Authorized Representative listed above.

Authorized Representative may extend the Offer Due Date when it is in the best interest of the agency. The agency reserves the right to reject all and/or to cancel this RFQ if it is in the best interest of the agency.

Submission Checklist

· Include the completed Pricing Sheet (Attachment # 1).

· Include statement of security certification.

· Include the necessary requested items for the Technical and Management requirements for review.

· Include past projects that have been completed of a similar scope to what is being requested in this RFQ.

· Please note: PERS reserves the right to ask for references.

Submitted Quotes Subject to Disclosure as Public Records.

If an Offeror includes information and data with its submitted Quote that Offeror regards as proprietary, privileged, or otherwise confidential; Offeror must identify such information in a separate document submitted with its Quote and provide a redacted submission along with the original submission. Otherwise, State will assume that Offeror consents to public disclosure of the original submission.

RFQ Evaluation RFQ submissions will be reviewed to determine if all requirements have been met. Those meeting the requirements will be evaluated to determine the “Best Value” for the agency. “Best Value” is based solely on the evaluators determination of what best meets the needs of the agency, price, and other factors such as: experience, expertise, availability, and resource capacity will be considered.

The offeror with the most advantageous submission will be awarded a contract. The Authorized Representative may negotiate contract terms and conditions with the successful offeror.

The agency intends to use the following criteria as evaluating factors for all submittals out of 100 points. The agency reserves the right to request written clarification or additional information as necessary to evaluate responses, or to conduct interviews to facilitate the evaluation process.

The following merit-based evaluation criteria will be utilized:

· Technical

· Resources and Project Management

· Cost

Technical

· Provide an explanation in detail on the approach to the statement of work and how it will be accomplished. The explanation should demonstrate a clear understanding of the goals and objectives for this project. (40 points maximum)

Resources and Project Management

· Provide a brief historical and current summary of the organization. (8 points maximum)

· Provide and organizational chart noting the names of the individuals that will be committed to this project. (8 points maximum)

· Provide resumes/bio of staff that is committed to this project. (8 points maximum)

· Provide your committed staff’s availability to be able to start and complete this project. (8 points maximum)

Cost Complete and include the pricing sheet with your submittal. Ensure that the pricing sheet is clear, precise, and compliments the service that is being requested with the requirements of this RFQ. (28 points maximum)

Award The Offeror with the highest-scored Quote after Tier 1, or subsequent tiers if conducted, will be awarded a Contract in a form substantially similar to the Work Order Contract form attached to the MPSA. PERS may negotiate Contract terms and conditions with the successful Offeror. PERS may award less than the full scope described in this RFQ.

CONTRACT AWARD DETERMINATION IS FINAL BASED ON THE SCORES PROVIDED BY THE EVALUATION COMMITTEE, SUBJECT TO A TIMELY, COMPLIANT AWARD PROTEST FROM AN ADVERSELY AFFECTED OFFEROR.

AWARD PROTEST OPPORTUNITY CONSISTENT WITH ORS 279B.410. PERS will provide a seven (7) calendar day period following release of any Notice of Intent to Award (“Notice”) during which an adversely affected Offeror may protest such award. An Offeror who claims to have been adversely affected by the selection of a competing Offeror shall have seven (7) calendar days from the date of such Notice in which to deliver a signed protest to PERS. Adversely affected Offerors will have until 5:00 p.m. Pacific Time, on the protest deadline date to submit a protest in accordance with the requirements in ORS 279B.410.

The submitted protest must bear the signature of a company official authorized to represent Offeror’s interests. Offerors may use an electronic signature copy via email to satisfy the protest submission deadline, provided they mail the original protest to the PERS postmarked no later than the protest submission deadline. To be adversely affected, an offeror must demonstrate that all higher ranked quotes were ineligible for selection. PERS will not consider a protest submitted after the deadline. Protests will be resolved according to Oregon Administrative Rules. PERS will not consider protests that do not include the information required under ORS 279B.410.

RFQ Attachments # 1, 2, and 3 to follow, beginning on the next page. Attachment # 2 includes two document objects. By such reference, the following three (3) attachments and their respective content are incorporated into the RFQ.

1. Attachment # 1, Pricing Sheet

2. Attachment # 2, Two embedded Document Objects re: QCP Process

3. Attachment # 3, RFQ Security Section for Professional Services Procurement

Attachment # 1

PERS-RFQ#2023-05

Hosting Site Analysis

RFQ Pricing Sheet

The offeror agrees to provide the services described in the statement of work for this Hosting Site Analysis RFQ, for the following sums:

RFQ Submittal prepared by: ______________________________________ Title: ________________________________________________________ Address: ______________________________________________________ Phone #: ______________________________________________________ Email Address: ________________________________________________ Authorized Signature: ___________________________________________

Attachment # 2

Embedded Documents: PERS QCP Process and PERS Modernization Program Charter

PERS QCP Process Document

Attachment # 3

Security Section for Professional Services Procurement

INFORMATION SECURITY POLICIES

PERS Information Security Policies

Enterprise Information Services (EIS) – Cyber Security Services (CSS) https://www.oregon.gov/das/OSCIO/Pages/Security.aspx

Statewide Information Security Standards State of Oregon: OSCIO - Security general guidance image1.png image2.emf

QCP Process.pdf

Oregon PERS Page 1 of 3 2/12/2018

SL2

PERS Quality CheckPoint (QCP) Process for Review and Acceptance of Contractual Deliverable Artifacts

PERS has a formal QCP review and acceptance process for deliverable artifacts specified as part of contracted work. The QCP process is a combination of manual and automated steps involving various PERS and vendor roles.

The main QCP process roles are as follows:

PERS Stakeholder: choose Reviewers, and make the Final Decision on acceptance

PERS Reviewers: review the submitted Artifact(s), and provide review feedback and recommendations to Stakeholder for further consideration

PERS QCP Coordinator: facilitate QCP processing, answer questions, monitor progress and timeliness, help resolve issues, etc.

PERS Project Lead: included as FYI to enable status tracking on related project

Vendor Author(s): prepare and submit the deliverable Artifact(s), make changes as appropriate

Vendor Contact: included as FYI to facilitate subsequent invoice submission

PERS Invoice Coordinator: included as FYI to facilitate subsequent invoice processing

The following description provides a high‐level view of this process and the interactions required of various roles, particularly vendor representatives.

1. Vendor: resources perform the contractually specified work, and Author(s) prepare the contractually specified deliverable Artifact(s) (e.g., documents/reports, diagrams, test results, meeting minutes, etc.).

2. PERS: identifies a Stakeholder, who will be responsible for the final acceptance decision on the submitted Artifact(s), and a QCP Coordinator, who will be responsible for processing the submitted Artifact(s) through the QCP process.

3. Vendor Author(s): verifies with the Stakeholder that the Artifact(s) are adequately complete and informally reviewed prior to submitting the Artifact(s) for QCP. When the Stakeholder agrees, submits the Artifact(s) to the QCP Coordinator via email attachments along with related identifying information, copying the PERS Stakeholder and PERS Project Lead.

4. PERS Stakeholder: decides which Reviewers are needed to provide thorough review feedback on the Artifact(s); this typically includes a variety of subject matter experts as appropriate for the type of Artifact(s) (e.g., technical, business, end users, etc.).

5. PERS QCP Coordinator: sets up the QCP, Stakeholders and Reviewers, Review and Decision due dates and Acceptance Criteria as specified in the contract, attaches the submitted Artifact(s), and activates the QCP. Activation notification emails are automatically sent to the Stakeholder and Reviewers, with FYI copies to other roles (e.g., Author, Project Lead, etc.).

6. PERS Reviewer(s): review the Artifact(s) as appropriate, listing Review Issues with artifact locations, supporting details, and recommended priorities for each. After completing their review, each Reviewer completes their Decision Recommendation; Recommendation notification emails are automatically sent to the Stakeholder for consideration in the final decision. (If reviews are not completed by the specified Review Due Date, Late notification emails are automatically sent as reminders.)

QCP Process vendor view v08.docx

Oregon PERS Page 2 of 3 2/12/2018

7. PERS Stakeholder: when all reviews are completed, or the Decision Due Date has arrived, considers review input as appropriate, decides which Review Issues need to be addressed, provides additional comments and priorities as appropriate, and works with Author(s) to communicate and agree on the changes to be made to the Artifact(s), and makes a Final Decision (see decision options below) depending on the quantity and substance of the Review Issues; Decision notification emails are automatically sent to appropriate roles, including Author, Vendor Contact, and Stakeholder:

a. Accept As Is: Artifact(s) require no changes

b. Accept with Agreed Changes: Agreed Changes must be made to the Artifact(s) and the revised versions provided to the PERS Stakeholder, but not resubmitted for QCP

c. Do Not Accept: the Artifact(s) must be revised to resolve the Review Issues, verified with the PERS Stakeholder, and then resubmitted to the QCP process for another review and acceptance cycle

8. Vendor Author(s):

a. If the Stakeholder’s decision is “Accept with Agreed Changes”: make appropriate changes to resolve Review Issues and provide updated revisions to Stakeholder

b. If the Stakeholder’s decision is “Do Not Accept”: make appropriate changes to resolve

Review Issues, verify readiness with Stakeholder, and resubmit Artifact(s) for QCP

9. Vendor Contact:

a. If the Stakeholder’s decision is “Accept with Agreed Changes” or “Accept As Is”: submit related invoices to PERS for payment processing

The default review period is 7 PERS business days (days where the PERS office is open for business, excluding weekends and holidays), but this may differ by contract. This review period is triggered when the deliverable is submitted to PERS for QCP, and ends with the final acceptance decision.

The diagram on the following page illustrates the above process description.

Oregon PERS Page 3 of 3 2/12/2018 image3.emf

1.10.01.01.005.POL.pdf

Oregon Public Employees Retirement System Posted date

July 20, 2017

Number

1.10.01.01.005.POL

Signature

Steve Rodeman Approval date

July 12, 2017

Page

Policy: Physical Security – Facility Access Controls

Objective: Establishes the requirement to manage physical security of agency facilities.

References: Physical Security – Access Controls standard

Information Security Policy Exception Request, Risk Acceptance Procedure

Origination date: June 7, 2017

Last revision date: June 17, 2017

Last review date: June 17, 2017

Physical Security – Facility Access Controls Policy

1. Overview

This policy applies to the implementation of physical security controls established to protect PERS data resources, hardware, and property.

2. Purpose

The application of Physical Security – Facility Access Controls policy and standards is intended to accomplish the following:

Limit physical access to electronic information systems and the facilities in which they are housed to authorized individuals only.

Safeguard facilities and equipment from unauthorized physical access, tampering, and theft.

Control and validate a person’s access to facilities based on role.

To track repairs and modifications to physical components related to security, i.e., card readers, cameras, etc.

3. Scope

Physical Security – Facility Access Controls policy and standards apply to all individuals who are authorized to access agency facilities.

Facilities are designated as:

Headquarters (HQ) located on 68th Parkway in Tigard, Oregon

The Tualatin facility located on Boones Ferry Road in Tualatin, Oregon

The PERS office located in the State Archives building in Salem, Oregon

Physical Security – Facility Access Controls

The Physical Security – Facility Access Controls standards document provides a tailored approach to all three PERS facilities to ensure that assets (hardware, software, and data) are afforded appropriate levels of protection against unauthorized access, unauthorized change, and disruption or denial of service. The standard also establishes roles, responsibilities, and specific practices with which individuals must comply to achieve physical security access objectives.

All PERS facilities must be protected by physical controls appropriate to the size and complexity of the operations and the sensitivity of assets housed within.

Authorized visitors must be recorded, identified, and escorted through restricted areas.

4. Policy:

Access Badges

This policy sets forth the requirement that all individuals granted access to restricted areas at PERS facilities be authorized, and that authorization is granted via physical and technical means.

All access to and movement within PERS restricted facilities must be tracked via the use of access cards.

Access cards allow entry into designated restricted areas based on the role the individual performs.

An additional photo identification badge provides a visual means for workers to identify authorized employees and contract staff.

Public Areas

All agency facilities are controlled access environments with the exception of the designated public areas.

The public area at the HQ facility in Tigard consists of the reception area, restrooms, and the

Boardroom on the second floor.

The PERS office at the State Archives building in Salem, which are within the public areas maintained by the property manager, and do not fall within the scope of this policy.

The Tualatin facility does not have a public area.

Physical Security – Facility Access Controls

5. Policy Compliance

5.1 Compliance Measurement

The Information Security Team will verify compliance to this policy through various methods, including but not limited to, periodic walk-throughs, reports, internal and external risk/maturity assessments, and feedback from the policy owner.

5.2 Exceptions

Any exception to this policy must be approved by the Chief Information Security Officer in advance. Note: See Information Security Policy Exception Request, Risk Acceptance

Procedure.

5.3 Oversite and training requirements

The Information Security Section will oversee Facility Access Controls compliance and provide formal training for all personnel.

5.4 Non-Compliance

Employees, employers, and contractors found to have violated this policy may be subject to disciplinary action, up to and including removal of access to PERS networks and facilities or termination of employment or contract.

6. Related Standards, Policies and Processes

Physical Security – Facility Access Controls standard

Information Security Policy Exception Request, Risk Acceptance Procedures

7. Definitions and Terms

NA

8. Revision History

Date of Change Responsible Summary of Change

6/1/2017 Teresa Stevens New policy creation

06/17/2017 Shane Perry Slight revision based on OSCIO feedback image4.emf

1.10.01.01.003.POL.pdf

June 7, 2012

1.10.01.01.003.POL

Paul Cleary

June 7, 2012

Policy: Data Classification and Information Handling

Objective: Ensures information assets are identified, properly classified, and protected throughout their lifecycles.

Reference: Information Handling Standards

Origination date: September 6, 2005

Last revision date: April 19, 2012

Last review date: April 19, 2012

Policy

Like other assets, information must be properly managed from creation to disposal. Not all information has the same level of sensitivity or importance to the agency; therefore, information requires different levels of protection. Classification and data management are critical to ensure the agency’s information assets have a level of protection corresponding to the sensitivity of the information.

This policy applies to all information assets regardless of the medium on which it is stored, including but not limited to paper, electronic, magnetic, and film.

All employees are responsible for maintaining the confidentiality, integrity, and availability of the agency’s information assets according to this policy.

All information will be classified, managed, and labeled as outlined in this policy and the information handling standards based on its level of sensitivity. Each division is responsible for identifying, classifying, and managing its information assets as outlined in this policy.

Proper levels of protection will be implemented to protect these assets relative to their classification.

Information assets must be protected in the manner required in the information handling standards.

This policy is subject to the limitations and conditions of Oregon public records law Oregon Revised Statute (ORS) 192. This policy is modeled after and complies with the Department of Administrative Services (DAS) Information Asset Classification policy (107-004-050).

Default classification level Information that is not labeled and cannot be easily identified as Level 1 should be handled as described in this document for Level 2.

http://www.leg.state.or.us/ors/192.html http://oregon.gov/DAS/OP/docs/policy/state/107-004-050.pdf

Data Classification and Information Handling

Classification levels Information owners shall identify information assets for the purpose of defining the level of sensitivity.

Divisions must use the classification schema included in this policy to differentiate between various levels of sensitivity.

All information assets shall be classified according to their level of sensitivity as follows:

Level 1, Published Information that is not protected from disclosure that if disclosed will not jeopardize the privacy or security of agency employees, clients, or partners. This includes information regularly made available to the public via electronic, verbal, or hard copy media.

Examples: Press releases, brochures, pamphlets, public access Web pages, and materials created for public consumption.

Level 2, Limited Information that may not be protected from public disclosure but if made easily and readily available may jeopardize the privacy or security of agency employees, clients, or partners. The agency shall follow its disclosure policies and procedures before providing this information to external parties.

Examples: Enterprise risk management planning documents, names, and addresses that are not protected from disclosure, such as work address, work email address, work phone numbers, etc.

Level 3, Restricted Sensitive information that may be exempt from public disclosure because, among other reasons, such disclosure will jeopardize the privacy or security of agency employees, clients, partners, or individuals who otherwise qualify for an exemption. Information in this category may be accessed and used by internal parties only when specifically authorized to do so in the performance of their duties. The agency shall follow its policies and procedures before providing this information to external parties.

Examples: Sensitive internal management documents such as budget development documents, Network diagrams, personally identifiable information, or any information that can be directly tied to a member, such as a PERS ID number, Social Security number (SSN) (redacted or not), address, telephone number, email address, etc. Does not apply to a work address, work email address, work phone number, etc.; documents with completed member information; screen prints; disability information; security audit reports; and any information exempt from public records disclosure (see ORS 192.501 and ORS 192.502).

Level 4, Critical Information deemed extremely sensitive and is intended for use by named individual(s) only.

This information is typically exempt from public disclosure because, among other reasons, such disclosure would potentially cause major damage or injury up to and including death to the named individual(s), agency employees, clients, partners, or cause major harm to the agency. The agency shall follow its disclosure policies and procedures before providing this information to external parties.

Examples: Disclosure that could result in loss of life, disability or serious injury, and information that is typically exempt from public disclosure. The agency does not usually maintain Level 4 information.

Information asset protection Each information asset classification will have a set or range of controls designed to provide the appropriate level of protection of the information commensurate with the sensitivity of the information in that classification. Information that is aggregated must be protected at the highest classification level. Refer to the Information Handling Standards document for the appropriate protection methods of each classification level.

Information owner responsibilities An information owner is a person or group of people with authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal. The deputy director owns all enterprise systems such as jClarety and FileNet. The deputy director delegates authority to division administrators to manage access to specific program areas.

Division administrators delegate management of specific business processes to section managers.

The systems are designed to allow access by role. Only those employees assigned a role can access data needed to complete their assigned tasks.

Ad-hoc reports developed through these systems are owned by the section manager from which the report was created.

Information owners are responsible for:

establishing processes for identifying information assets and assigning classification levels to data;

establishing procedures in support of decision making regarding controls, access privileges of users, and ongoing information management;

ensuring the information is regularly reviewed for value and updated to manage changes to risks due to new threats, vulnerabilities, or changes in the environment;

establishing practices for periodic reclassification based on business impact analysis, changing business priorities or new laws, regulations, and security standards; and enforcing state archive document retention rules regarding proper disposition of all information assets.

Labeling As an aid that helps enable all parties to correlate the information with the appropriate information handling standards, information owners are responsible to ensure information assets are labeled.

Information should be properly labeled so users are aware of its classification. Information assets must be labeled as required in the information handling standards.

Proper disposal All electronic, paper, and physically recorded information assets must be disposed of in a manner consistent with the classification of the information asset and comply with all established state of Oregon archive laws, rules, and regulations. For disposal of electronic equipment, refer to the DAS Sustainable Acquisition and Disposal of Electronic Equipment (E-Waste/Recovery) policy 107-009- 0050.

Release of sensitive information Employees will not release sensitive information related to members, employees, employers or other information classified as Level 3 – Restricted, or Level 4 – Critical, unless otherwise permitted by this policy or required by law.

Releasing authorities The executive director, deputy director, and division administrators (releasing authorities) are given the authority to release sensitive information. It is the responsibility of the releasing authority to ensure that the distribution of sensitive information does not violate public law or cause a possible breach of fiduciary duty to the PERS Trust or its members. The releasing authority may delegate, in writing, his or her authority to agency employees if it is deemed appropriate and conforms to the requirements established by this policy. This delegation must specifically identify the type of information employees may release and what kind of supporting documentation is required to conform to this policy.

http://oregon.gov/DAS/OP/docs/policy/state/107-009-0050.pdf http://oregon.gov/DAS/OP/docs/policy/state/107-009-0050.pdf

Unless otherwise specifically stated in this policy or directed by the releasing authority, sensitive information can only be released to the member, retiree, or other appropriate agency staff. Exceptions to this policy are allowed when the release of sensitive information is authorized:

1. in writing by the member or retiree;

2. by application of legal standards or processes, such as subpoenas;

3. in writing by, and upon documented identification of, a deceased member’s or retiree’s beneficiary(ies); or

4. through a confidentiality statement in a contract.

Release of information to employers Sensitive information received from an employer or other source may be reconfirmed without prior authorization as required in this policy. The sensitive information released is limited only to that information originally provided by the employer and is to be released on a need-to-know basis to persons acting in an official capacity on behalf of the employer and authorized by that employer to have access to the information.

Use of Social Security number (SSN) Federal and state laws dictate how and when a SSN can be used to conduct business.

The Social Security Act and 1974 Federal Privacy Act permit the use of a member’s SSN for Social Security administration and in certain circumstances. The Oregon Consumer Identity Theft Protection Act restricts the use of an SSN when used with a name. Government entities (like PERS) cannot use SSNs for any purpose unless that purpose is specifically allowed by law or authorized by the SSN holder.

PERS cannot use an SSN without a member’s permission. When a member calls, do not say: “What is your SSN?” Inform the member for the reason of the inquiry and get his/her permission: “If you permit me to use your SSN, I can look you up on our system quickly.” If the member gives permission, it is okay to use the SSN during the current call.

PERS will only use an SSN in hard copy correspondence when a record(s) or information is needed from another agency or entity and the only way to identify the member is by using the SSN, unless the individual has given us permission to use it for that purpose.

Every PERS member has a PERS ID number that can be used to identify a member. Use the PERS ID number in correspondence, and ask the member to use that number when contacting PERS.

Using a full nine-digit SSN on correspondence, email, or fax is not allowed. Any use of SSN using these methods must be redacted to show only the last four digits of the SSN.

If allowed or required by a section’s procedures, a form with an entire (nine numbers) SSN can be returned to a member by mail if the member supplied the SSN on the form. The form cannot be faxed or emailed without redaction or encryption.

PERS is allowed to use SSNs for tax reporting purposes; therefore, some forms require members to provide their SSN. Each form indicates whether a member’s SSN is required.

Compliance Information owners may, based upon individual business needs or legal requirements, specify security requirements that exceed those put forth in this document but must, at a minimum, achieve the security objectives defined in this policy.

Violation of this policy or associated policies, standards, guidelines, or procedures can result in limitation, suspension, or revocation of system privileges and can lead to other disciplinary action up to and including dismissal for employees or termination of contracts for contractors, vendors, or business partners. Violations may also result in civil and/or criminal prosecution.

Employee print name Employee signature

Date

Level 2 - Limited Page: 1 of 13

Information Handling Standards Updated June 4, 2012

If users have any questions concerning these standards, they should contact their immediate supervisor, the agency records officer, information security officer, or ISD administrator.

Asset Protection Each information asset classification will have a set or range of controls designed to protect the information commensurate with the sensitivity of the information in that classification. Information that is aggregated must be protected at the highest classification level.

Level 1 - Published Level 2 – Limited Level 3 – Restricted Level 4 - Critical

Data does not require special handling or safeguards.

Data must have reasonable safeguards such as filing in a drawer or other area where it cannot be readily viewed by the public. Level 2 data may be sent electronically or mailed without special security controls at the discretion of the information owner.

Data should always be kept locked in a secure location. Multiple layers of protection such as a secure building, access control, and locked offices within a building are adequate protection.

Electronic transmission of data with personally identifiable information must be secured via encryption or secured form of transport.

Disclosure, transmission, or dissemination of data must be authorized by the information owner.

Data must always be kept locked in a secure location (e.g., cabinet, safe, etc.). Electronic transmission of data must be secured via encryption and such safeguards as digital certificates. Disclosure, transmission, or dissemination of data must be authorized and documented by the executive director, deputy director, or a division administrator.

Whenever and wherever possible, information should be stored in a separate, secure area.

Level 2 - Limited Page: 2 of 13

Personally Identifiable

Information (PII)

As defined by ORS 646A.602(11) Personally Identifiable Information means:

(a) Consumer’s first name or first initial and last name in combination with any one or more of the following data elements when the data elements are not rendered unusable through encryption, redaction, or other methods or when the data elements are encrypted and the encryption key has also been acquired:

A) Social Security number;

B) driver’s license number or state identification card number issued by the Department of Transportation;

C) passport number or other United States issued identification number; or

D) financial account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to a consumer’s financial account.

(b) any of the data elements or any combination of the data elements described in paragraph (a) of this subsection when not combined with the consumer’s first name or first initial and last name and when the data elements are not rendered unusable through encryption, redaction, or other methods if the information obtained would be sufficient to permit a person to commit identity theft against the consumer whose information was compromised.

Level 2 - Limited Page: 3 of 13

Release to Third

Parties

Available to the general public and for distribution outside of the agency.

Intended for use only within the agency.

Access is limited to as few persons as possible on a need to know basis.

Access is limited to named persons on a need to know basis.

May be shared outside the agency only if there is a legitimate business need to know, and follows appropriate policies and procedures.

Release only permitted by appropriate policies and procedures.

Release only permitted by appropriate policies and procedures.

Labeling Labeling is an aid that helps enable all parties to correlate the information with the appropriate information handling standards. Information should be properly labeled so users are aware of its classification.

No label Not required.

To help differentiate between Level 1 and Level 3, labels may be used at management’s discretion.

Required.

Labels are to be placed on the bottom left portion of the document when possible.

For example, Word and Excel documents should contain the label in the bottom left footer.

Level 2 - Limited Page: 4 of 13

Guidelines

The preferred labeling schema is SL2 (all caps) without spaces, additional wording, or notations.

schema is SL3 (all caps) without spaces, schema is SL4 (all caps) without spaces, Email When sending email to a mailbox outside of the PERS email system (i.e. contractor, employer, member, DAS, vendor, etc.), you must add a confidentiality note to the email. The verbiage to use is:

CONFIDENTIALITY NOTE: All information in this email, including attachments, is approved solely for delivery to and authorized use by intended recipients. Use, dissemination, distribution, or reproduction of this message and/or any of its attachments by unintended recipients is not authorized and may be unlawful. If you are not an intended recipient of this message or an authorized assistant to an intended recipient, please notify the sender by replying to this message and then delete it from your system.

No label. Not required. Required.

Labels for (internal and external) email should be in the emails signature.

Any person that sends, replies, or forwards an email to another is the owner of that email and is required to ensure the appropriate label is used.

Labels for (internal and external) email should be in the emails signature.

Any person that sends, replies, or forwards an email to another is the owner of that email and is required to ensure the appropriate label is used.

Level 2 - Limited Page: 5 of 13

Electronic files Level 1 - Published Level 2 – Limited Level 3 – Restricted Level 4 - Critical

No Label. Not Required. Required.

Should be named to comply with these labeling requirements so the user does not need to open a file to determine its classification. As an example, a file could be named SL3_filename.ext

Management may store like classified documents in a network folder named using the above labeling three character code such as SL3_Files, or similar methods that comply with the intent of this policy. If a file is moved from this location, renaming the file should be considered.

Should be named to comply with these labeling requirements so the user does not need to open a file to determine its classification. As an example, a file could be named SL4_filename.ext

Management may store like classified documents in a network folder named using the above labeling three character code such as SL4_Files, or similar methods that comply with the intent of this policy. If a file is moved from this location, renaming the file should be considered.

Paper documents Level 1 - Published Level 2 – Limited Level 3 – Restricted Level 4 - Critical

No label. Not required. Required.

Level 2 - Limited Page: 6 of 13

Information handling Information assets must be handled in a manner that protects the information asset from unauthorized or accidental disclosure, modification, or loss.

Transmission by mail, fax, email

Interoffice mail No special handling required.

No special handling

Interoffice envelope marked and labeled

“SL3.”

Sealed interoffice envelope marked and labeled “SL4.”

Mail outside the agency

First class USPS mail, state shuttle service.

Mail containing more than 100 records of Personally Identifiable Information per package or envelop, trackable delivery required. (e.g., state shuttle PacTrac, messenger, FedEx, U.S.

Express, USPS certified, or return receipt mail).

Trackable delivery required. (e.g., state shuttle PacTrac, messenger, FedEx, U.S.

Express, USPS certified, or return receipt mail).

Level 2 - Limited Page: 7 of 13

Email within the

Refrain from use of personally identifiable information. Follow data classification policy.

Signature line in email must be labeled SL3.

Use of email strongly discouraged unless encrypted.

Refrain from use of information. Follow data classification policy.

Signature line in email must be labeled SL4.

discouraged unless

Email going outside of the

Use of personally identifiable information prohibited, unless encrypted or emergency situation.

discouraged.

Use of information prohibited, unless encrypted or emergency situation.

discouraged.

Location of fax machine

Located in area not easily accessible to general public.

accessible to general public and unauthorized persons.

accessible to general public and unauthorized persons.

Fax transmission No special handling

Reasonable care in dialing.

When sending information, telephone confirmation of receipt.

Prohibited.

Fax coversheet Required. Required. Required. N/A

Level 2 - Limited Page: 8 of 13

Storage of information All information assets should be processed and stored in accordance with the information asset classification levels assigned to protect the confidentiality, integrity, availability, and level of sensitivity.

Level 1 – Published Level 2 – Limited Level 3 – Restricted Level 4 – Critical

Printed material No special precautions

Reasonable precautions to prevent access by non-employees.

Stored within an access controlled building, office, cabinet, etc.

Two layers of physical security such as within an access controlled building and stored in a lockable enclosure (cabinet, safe, etc).

Electronic documents

No special precautions non-employees.

Unless encrypted, personably identifiable information must be stored on network file system.

Access is controlled by

Backup tapes are information must be named persons on a need to know basis.

Email No special precautions unauthorized personnel.

personably identifiable information must be

Level 2 - Limited Page: 9 of 13 on a “need to know basis.”

“named” persons on a “need to know basis.”

Destruction of information

All electronic, paper, and physically recorded information assets must be disposed of in a manner consistent with the classification of the information asset and comply with all established state of Oregon archive laws, rules, and regulations. For disposal of electronic equipment, refer to the DAS Sustainable Acquisition and Disposal of Electronic Equipment (E-Waste/Recovery) policy 107-009-0050.

Location of Waste Paper Bins

Area not accessible to unauthorized persons.

Area not accessible to unauthorized persons.

Paper recycling Permitted. Permitted. Prohibited.

Place materials in locking recycle bins.

Destruction or shredding is required.

Prohibited.

Place materials in locking recycle bins.

Destruction or shredding is required.

Magnetic media / diskettes

Destroy in a manner that protects sensitive information.

Destroy in a manner that protects sensitive information.

Level 2 - Limited Page: 10 of 13

Physical security of

Information assets must be physically secured in a manner that protects the information asset from unauthorized or accidental disclosure, modification, or loss.

Computers Position or shield screen to prevent viewing by unauthorized parties.

Use password screen saver.

Lock workstation, logoff, or shut down/restart when leaving work area.

Position or shield screen

Laptops Position or shield screen

Use a physical locking mechanism (i.e., a cable

Level 2 - Limited Page: 11 of 13 lock) to protect device from theft when not secured in the work place.

secured in the work secured in the work

Use full disk encryption.

secured in the work

Use full disk encryption.

Servers Physical access to servers restricted.

Access is limited to as

Physical access to

Access is limited to as

Access is limited to as

Access is limited to as

Printers No special precautions

Print documents only when necessary.

Documents should be retrieved as soon as possible and not be left unattended after business hours unless in a secured area.

Print documents only when necessary.

Documents should be retrieved as soon as possible and not be left unattended unless in a secured area.

Facilities access No special precautions

Access to areas containing sensitive information should be physically restricted.

Information should not be readily viewable when left in an unattended room.

Access to areas containing sensitive information should be physically restricted.

Information must be locked up when left in an unattended room.

Level 2 - Limited Page: 12 of 13

Portable devices Reasonable precautions to prevent unauthorized access, loss, or theft.

Personally identifiable

Information must be

Access control Available to the general public.

Generally available to all authorized users on a need to know basis.

Information owner ensures adequate measures and controls are in place to limit access to as few persons as possible.

measures and controls are in place to limit access to named persons

Access review No special precautions

Access granted by the

Management must perform periodic review of access.

Access granted by the

Management must perform periodic review…