Professional Services Supplemental.pdf

SUDTS - DOC

Solicitation #: BPM055259

Professional Services Supplemental Page 1 of 9 Effective Date: July 2024

Professional Services Supplemental This supplemental contains additional requirements under Section 2 of the solicitation.

1. Security Requirements The following requirements are applicable to the Contract:

1.1.Employee Identification A. Contractor Personnel shall display his or her company ID badge in a visible location at all times while on State premises. Upon request of authorized State personnel, each Contractor Personnel shall provide additional photo identification.

B. Contractor Personnel shall cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for State badge issuance.

C. Contractor shall remove any Contractor Personnel from working on the Contract where the State determines, in its sole discretion, that Contractor Personnel has not adhered to the Security requirements specified herein.

D. The State reserves the right to request that the Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the Contract.

1.2.Security Clearance / Criminal Background Check The State reserves the right to refuse any individual Contractor Personnel to work on State premises, based upon certain specified criminal convictions, as specified by the State.

A. A criminal background checks for each Contractor Personnel providing on-site services shall be completed prior to each Contractor Personnel providing any on-site services under the Contract.

B. The CCHU Background Screening Memo (Exhibit 13) and Vendor Applicant Forms Packet (Exhibit 14) shall be completed for each applicant prior to background screening.

C. The Contractor shall obtain from each individual assigned to work on the Contract a statement permitting a criminal background check. The State will obtain a criminal background check for each individual using a source of its choosing.

The Contract Monitor reserves the right to reject any individual based upon the results of the background check.

D. Persons with a criminal record may not perform services under the Contract unless prior written approval is obtained from the Contract Monitor. The Contract Monitor reserves the right to reject any individual based upon the results of the background check. Decisions of the Contract Monitor as to acceptability of a candidate are final.

E. The CJIS criminal record check of each Contractor Personnel who will work on State premises shall be reviewed and documented by the Contractor for convictions of any of the following crimes described in the Annotated Code of Maryland, Criminal Law Article:

Professional Services Supplemental Page 2 of 9 Effective Date: July 2024

1) §§ 6-101 through 6-104, 6-201 through 6-205, 6-409 (various crimes against property);

2) any crime within Title 7, Subtitle 1 (various crimes involving theft);

3) §§ 7-301 through 7-303, 7-313 through 7-317 (various crimes involving telecommunications and electronics);

4) §§ 8-201 through 8-302, 8-501 through 8-523 (various crimes involving fraud);

5) §§9-101 through 9-417, 9-601 through 9-604, 9-701 through 9-706.1

(various crimes against public administration); or

6) a crime of violence as defined in CL § 14-101(a).

F. Contractor Personnel that would have access to systems supporting the State or to State data who have been convicted of a felony or convicted of a crime involving telecommunications and electronics or convicted within the past five (5) years of a misdemeanor from the above list of crimes shall not be permitted to work on the Contract.

G. A particular on-site location covered by the Contract may require more restrictive conditions regarding the nature of prior criminal convictions that would result in Contractor Personnel not being permitted to work on those premises. Upon receipt of a location’s more restrictive conditions regarding criminal convictions, the Contractor shall provide an updated certification regarding the Contractor Personnel working at or assigned to those premises.

1.3.On-Site Security Requirement(s) A. For the conditions noted below, Contractor Personnel may be barred from entrance or leaving any site until such time that the State’s conditions and queries are satisfied.

1) Contractor Personnel may be subject to random security checks when entering and leaving State secured areas and may be barred from entrance or exit until such time that the State’s conditions and queries are satisfied. The State reserves the right to require Contractor Personnel to be accompanied while in secured premises.

2) Some State sites, especially those premises of the Department of Public Safety and Correctional Services, require each person entering the premises to document and inventory items (such as tools and equipment) brought onto the site, and to submit to a physical search of his or her person. Therefore, Contractor Personnel shall always have an inventory of tools being brought onto a site and be prepared to present the inventory, as well as the tools or equipment, to the State staff or an officer for review and inspection. Before leaving the site, the Contractor Personnel may again be required to present the inventory list and the tools or equipment for inspection. Upon both entering and exiting the site, State staff or a correctional or police officer may search Contractor Personnel. Depending upon facility rules, specific tools or personal items may be prohibited from being brought into the facility.

Professional Services Supplemental Page 3 of 9 Effective Date: July 2024

B. Any Contractor Personnel who enters the premises of a facility under the jurisdiction of the Department may be searched, fingerprinted (for the purpose of a criminal history background check), photographed and required to wear an identification card issued by the Department.

C. Further, Contractor Personnel shall not violate Md. Code Ann., Criminal Law Art.

Section 9-410 through 9-417 and such other security policies of the agency that control the facility to which the Contractor Personnel seeks access. The failure of any of the Contractor Personnel to comply with any provision of the Contract is sufficient grounds for the State to immediately terminate the Contract for default.

2. Department of Human Services (DHS) Hiring Agreement

All Bidders/Offerors are advised that if a Contract is awarded as a result of this solicitation, the successful Bidder/Offeror will be required to complete a DHS Hiring Agreement. A copy of this Agreement is included as Attachment V. This Agreement must be provided within five (5) Business Days of notification of recommended award.

3. Substitution of Personnel

If the solicitation requires that a particular individual or personnel be designated by the Bidder/Offeror to work on the Contract, any substitution of personnel after the Contract has commenced must be approved in writing by the Contract Monitor prior to the substitution. If the Contractor substitutes personnel without the prior written approval of the Contract Monitor, the Contract may be terminated for default which shall be in addition to, and not in lieu of, the State’s remedies under the Contract or which otherwise may be available at law or in equity.

4. Location of the Performance of Services Disclosure The Bidder/Offeror is required to complete and submit with the Bid/Proposal the Location of the Performance of Services Disclosure. A copy of this Disclosure is included as Attachment K.

5. HIPAA - Business Associate Agreement In the event the State determines that the functions to be performed in accordance with this solicitation constitute Business Associate functions as defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the recommended awardee shall execute a Business Associate Agreement as required by HIPAA regulations at 45 C.F.R.

§164.500 et seq. and set forth in Attachment T. This Agreement must be provided within five (5) Business Days of notification of proposed Contract award. However, to expedite processing, it is suggested that this document be completed and submitted with the Bid/Proposal. Should the Business Associate Agreement not be submitted upon expiration of the five (5) Business Day period as required by this solicitation, the Procurement Officer, upon review of the Office of the Attorney General and approval of the Secretary, may withdraw the recommendation for award and make the award to the responsible Bidder/Offeror with the next highest overall-ranked Bid/Proposal.

Professional Services Supplemental Page 4 of 9 Effective Date: July 2024

6. Information Technology Security

A. Contractors shall comply with and adhere to the State IT Security Manual, Policies and Standards. These policies may be revised from time to time and the Contractor shall comply with all such revisions. Updated and revised versions of the State IT Policy and Standards are available online at: Policies, Standards, and Guidelines.

B. The Contractor shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State as directed and coordinated with the Contract Monitor.

The Contractor shall:

1) For IT Security Policies and Standards that are no covered by the State IT Security Manual, the Contractor shall implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 7)

2) Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract; and

3) Ensure compliance with all applicable federal, State, and local laws, rules and regulations concerning security of Information Systems and Information Technology.

7. Data Protection and Controls A. Contractor shall ensure a secure environment for all State data and any hardware and software (including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract according to a written security policy (“Security Plan”) no less rigorous than that of the State and using best practices that comply with an accepted industry standard, such as the NIST cybersecurity framework.

B. To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls during the Contract Term (the Contractor may augment this list with additional controls):

1) Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not utilized in test or training environment(s).

2) Apply hardware and software hardening procedures as recommended by Center for Internet Security (CIS) guides, Security Technical Implementation Guides (STIG), or similar industry best practices to reduce the systems’ https://doit.maryland.gov/cybersecurity/Pages/policies-and-guidance.aspx https://doit.maryland.gov/cybersecurity/Pages/policies-and-guidance.aspx

Professional Services Supplemental Page 5 of 9 Effective Date: July 2024 surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control.

These procedures may include but are not limited to removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the Contractor’s system configuration files.

3) Ensure that State data is not commingled with non-State data through the proper application of compartmentalization Security Measures.

4) Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise directed, the Contractor is responsible for the encryption of all Sensitive Data.

5) Apply data encryption to all Contractor managed or controlled State data when the data is in transit over untrusted network segments.

6) Utilize encryption algorithms for encrypting data that comply with current Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules.”

7) Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers and information security standards, including the Maryland Department of Information Technology’s Information Security Manual.

8) Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and remediation, if required. The State shall have the right to inspect the logs and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under the Contract.

9) Ensure system and network environments are separated by properly configured and updated layer seven firewalls.

10) Restrict network connections between trusted and untrusted networks by physically or logically isolating systems from unsolicited and unauthenticated network traffic.

11) By default, “deny all” and only allow access by exception.

12) Review, at least annually and after changes, the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

Professional Services Supplemental Page 6 of 9 Effective Date: July 2024

13) Perform regular internal and external vulnerability testing of operating system, applications, and all network devices utilized in this Contract. Such testing is expected to identify outdated software versions; missing software patches; device or software misconfigurations; and to validate compliance with or deviations from the security policies applicable to the Contract.

Contractor shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and remediate the vulnerability no later than 30 days following the earlier of vulnerability’s identification or public disclosure, or document why remediation action is unnecessary or unsuitable. The State shall have the right to conduct vulnerability testing and inspect the results of similar Contractor performed vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

14) Enforce strong user authentication and password control measures to minimize the opportunity for unauthorized access through compromise of the user access controls. At a minimum, the implemented measures should be consistent with the most current Maryland Department of Information Technology’s Information Security Policies, including specific requirements for password length, complexity, history, and account lockout.

15) Ensure State data is not processed, transferred, or stored outside of the continental United States (“U.S.”). The Contractor shall provide its services to the State and the State’s end users solely from data centers in the U.S.

Unless granted an exception in writing by the State, the Contractor shall not allow Contractor Personnel to store State data on portable devices, including personal computers, except for devices that are used and kept only at its U.S.

data centers. Contractor Personnel may access State data remotely only as required to provide technical support and with the prior approval of the State.

16) Ensure Contractor Personnel shall not connect any of their own equipment to State IT assets without prior written approval by the State. Any such approval may be revoked, rescinded, or curtailed at any time for any reason.

The Contractor shall coordinate requests for approval with the Contract Monitor and is subject to all State approval processes as they may be revised from time to time.

17) Ensure that anti-virus and anti-malware software is installed and maintained on all systems and end points supporting the services provided under the Contract; that the anti-virus and anti-malware software is automatically updated; and that the software is configured to actively scan and detect threats to the system for remediation. The Contractor shall perform routine vulnerability scans and take corrective actions for any findings.

18) Conduct regular external vulnerability testing designed to examine the service provider’s security profile from the Internet without benefit of access to internal systems and networks behind the external security perimeter.

Evaluate all identified vulnerabilities on Internet-facing devices for potential adverse effect on the service’s security and integrity and remediate the

Professional Services Supplemental Page 7 of 9 Effective Date: July 2024 vulnerability promptly or document why remediation action is unnecessary or unsuitable. The State shall have the right to inspect the Contractor’s processes and the performance of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

8. Date Ownership and Access As set forth in the Contract, data, databases and derived data products created, collected, manipulated, or directly purchased as part of the solicitation are the property of the State. The purchasing State agency is considered the custodian of all State data. The use, access, and distribution of all data shall comply with the requirements of the Data Use Agreement (Attachment Y).

The Contractor may not access State data other than as necessary to perform the services under this Contract.

The Contractor shall limit access to and use of State data to Contractor Personnel whose responsibilities require such access or use and shall train such Contractor Personnel on the confidentiality obligations set forth herein.

At no time shall any data or processes – that either belong to or are intended for the use of the State or its officers, agents or employees – be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the State.

The Contractor shall not use any information collected in connection with the services furnished under the Contract for any purpose other than fulfilling such services.

Provisions in Section 8. shall survive expiration or termination of the Contract. Additionally, the Contractor shall flow down the provisions of Section 8. (or the substance thereof) in all subcontracts.

9. Security Logs and Reports Access A. For any cloud hosted, or Contractor, or third party hosted solution, the Contractor shall provide security logs and reports to the State in a mutually agreeable format.

B. Reports shall include latency statistics, user access, user access IP address, user access history and security logs for all State data, systems, and software data, systems, and software related to the Contract.

10. Security Incident Response A. The Contractor shall notify the State when any Contractor system that may access, process, or store State data or State systems experiences a Security Incident or a Data Breach as follows:

1) notify the State within twenty-four (24) hours of the discovery of a Security Incident by providing notice via written or electronic correspondence to the Contract Monitor, State Chief Information Security Officer and Maryland Security Operations Center (MD-SOC);

Professional Services Supplemental Page 8 of 9 Effective Date: July 2024

2) notify the State within seventy-two (72) hours if there is a threat to Contractor’s solution as it pertains to the use, disclosure, and security of State data; and

3) provide written notice to the State within one (1) Business Day after Contractor’s discovery of unauthorized use or disclosure of State data and thereafter all information the State requests concerning such unauthorized use or disclosure.

B. Contractor’s notice shall identify:

1) the nature of the unauthorized use or disclosure;

2) the State data used or disclosed,

3) who made the unauthorized use or received the unauthorized disclosure;

4) what the Contractor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and

5) what corrective action the Contractor has taken or shall take to prevent future similar unauthorized use or disclosure.

6) The Contractor shall provide such other information, including a written report, as reasonably requested by the State.

C. Discussing Security Incidents with the State should be handled on an urgent as-needed basis, as part of Contractor communication and mitigation processes as mutually agreed upon, defined by law or contained in the Contract. The Contractor shall obtain approval from the State prior to communicating with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise.

D. The Contractor shall comply with all applicable system security breach laws.

11. Data Breach Responsibilities A. If the Contractor reasonably believes or has actual knowledge of a Data Breach, the

Contractor shall, unless otherwise directed:

1) Notify the appropriate State-identified contact within 24 hours by telephone and email to the Maryland Security Operations Center (MD-SOC) in accordance with the agreed upon security plan or security procedures unless a shorter time is required by applicable law;

2) Cooperate with the State to investigate and resolve the data breach;

3) Promptly implement commercially reasonable remedial measures to remedy the Data Breach; and

4) Document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services.

Professional Services Supplemental Page 9 of 9 Effective Date: July 2024

B. With respect to State data within the possession or control of the Contractor, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by State law; (3) a credit monitoring service required by State or federal law; (4) a website or a toll-free number and call center for affected individuals required by State law; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause; all [(1) through (5)] subject to the Contract’s limitation of liability.

C. The public disclosure of a cybersecurity incident shall be pursuant to Guidelines for the Public Disclosure of Cybersecurity Incidents or any successor thereto..

https://doit.maryland.gov/cybersecurity/Documents/Cybersecurity-Guidelines-PDCI.pdf https://doit.maryland.gov/cybersecurity/Documents/Cybersecurity-Guidelines-PDCI.pdf https://doit.maryland.gov/cybersecurity/Documents/Cybersecurity-Guidelines-PDCI.pdf