REDACTED_Bulletproof_s_Technical_Response_to_State_of_Ohio_Security_Control_Assessment_SOW_DBDAS-24-06-005.pdf

The State of Ohio Ohio Benefits Security Control Assessment

#DBDAS-24-06-005

Technical Response

Page ii

Table of Contents

Cover Letter

Subcontractors Documentation

Assumptions

Payment Address

Section 6: Pre-Qualified Contractor’s Response to Scope of Work

6.1 Deliverables and Milestones

6.2 Bulletproof’s Methodology and Approach

6.3 Staffing and Resources

Section 7: Cost Summary

7.1 Rate Card

Preference Certification Statements

Proof of Insurance

Affirmation and Disclosure Form

List of Tables Table 1: Overview of Project Management Process Table 2: Description of Tools Table 3: Benefits of Solution Table 4: Our Services Table 5: Technology Expertise Table 6: Proposed Project Schedule Table 7: Proposed Personnel Table 8: Rate Card Role Table 9: Cost Summary Table 10: Rate Card

#DBDAS-24-06-005

Technical Response

Bulletproof’s Response | July 19, 2024 Page 1

Cover Letter July 19, 2024

State of Ohio, Department of Administrative Services Office of Information Technology – Ohio Benefits Program 30 E. Broad Street Columbus, OH 43215

RE: Bulletproof’s Response to the State of Ohio Department of Administrative Services Statement of Work (SOW) #DBDAS-24-06-005 for Ohio Benefits Security Control Assessment

To Whom it May Concern, Bulletproof Solutions, Inc. (Bulletproof) is pleased to provide the following response to the State of Ohio Department of Administrative Services (the Agency) Statement of Work (SOW) #DBDAS- 24-06-005 for providing a Security Control Assessment of the Ohio Benefits Program.

At Bulletproof, we provide a wide range of IT professional services, spanning from security services, managed IT services, solutions delivery to educational services – but at the core of all our service delivery is our focus on security. Like our name suggest, security is who we are.

Since our inception, we have focused on helping clients navigate the increasingly complicated security landscape. We do it through a combination of cybersecurity and governance, risk and compliance advisory services, as well as through our managed security services division. Our security experts have helped shape and assess the security programs against industry leading frameworks worldwide and we have decades of experience in delivering cybersecurity advisory services.

Notably, in May of 2024 we were awarded the title of Security Trailblazer at the 2024 Microsoft Security Excellence Awards.

Our priority is to satisfy every customer, every time, through outstanding personalized, ethical and protocol-conscious service. We commit to maintaining a focus on your objectives and striving to exceed your expectations. We take pride in our ability to bring value, stability, and superior service to our customers.

Bulletproof has been providing MARS-E consulting and independent security assessment services since 2012. Our group of MARS-E experts have supported the consulting and assessment needs of 25 states and commonwealth governments. Our experts have experience supporting the development of essential MARS-E documentation and conducting full MARS-E assessments and single year surveillance audits.

#DBDAS-24-06-005

Technical Response

Bulletproof’s Response | July 19, 2024 Page 2

Our MARS-E Services include the assessment of key MARS-E related artifacts, including, but not limited to the following, delivering compliance Security Assessment Reports.

Security and Privacy Assessment Plan – the roadmap for the annual MARS-E assessment, documenting all testing to be performed.

System Security Plan (SSP) – the roadmap of your IT security and privacy environment, and the tool to document the implementation of your security and privacy controls for the protection of all data received, stored, processes and transmitted by your IT systems and supporting applications.

Plan of Action and Milestones (POA&M) – a remedial action plan that helps identify and assess information system security and privacy weakness, sets priorities, and monitors progress toward mitigating any weaknesses.

Information Security Risk Assessment (ISRA) – an analysis of the risk to organizational operations, organizational assets, individuals, other organizations, and the nation due to the potential for unauthorized access, use, disclosure, disruption, modification, or destruction of information and/or information systems.

Privacy Impact Assessment (PIA) – an assessment of an information system, program or project that collects, uses, maintains or shares personally identifiable information (PII), which can be conducted either during development or procurement of the new system, project or program, or against existing systems and programs to ensure compliance with applicable legal, regulatory and policy requirements.

Our MARS-E services will help you not only document, organize and implement required security controls, but help you identify and remediate risks and vulnerabilities, and provide a plan for continual monitoring.

With Bulletproof’s MARS-E Services, we will help you:

Access federal or state funding to continue system upgrades and roll our new programs;

Obtain Authority to Connect to the Federal Data Services Hub to enable data sharing;

Limit risk and exposure for your organization and the citizens you serve; and

Ensure your SSP evolves as your programs and systems evolve.

Why Bulletproof?

Bulletproof has been at the fore of these MARS-E compliance changes, as one of the first independent assessors to start using the new SAR template in assessments. We have a good working relationship with CMS and an even stronger track record of thorough, reputable and, importantly, compliant SARs.

Bulletproof’s Response | July 19, 2024 Page 18

Our team will submit weekly progress reports identifying status of ongoing work, accomplishment of the past week and planned work for the week ahead. A log of interaction with the Agency’s staff will also be included as well as request for interviews and documentation.

We will submit meeting minutes for all progress and status meetings held with the Agency’s officials. Meeting notes will highlight any decision reached, agreements made, or actions to be taken.

Throughout this effort, our team will maintain continuous interaction with the Agency’s personnel at multiple levels.

As an IT consulting firm, we believe that professional consulting services must be viewed in terms of project execution life cycles. A complete life cycle consists of a range of technical and management services that are executed over allocated time and are focused at the granular level necessary to meet specific contract objectives. Such services may be broadly grouped and viewed as technical phases and management phases that constitute our integrated approach— allowing our team to coordinate key project resources and serve as a single point-of-contact for all of our clients’ needs. This approach has been successfully implemented for previous tasks in similar engagements and we believe it will be instrumental in meeting the objectives of this effort.

Conducting a successful assessment effort on the scale and scope required by the Agency relies not only on the skills and expertise level of the practitioners, but also on meticulous planning and oversight throughout the project.

Over the years, our team has developed a comprehensive management approach. This approach relies on the following cornerstones:

1. Understanding of the client’s expectations;

2. Detailed planning;

3. Strong team leadership;

4. Close coordination with the client;

5. Oversight by our executive management; and

6. Progress reviews and solicitation of feedback from the client.

Our team recognizes the value of continuous interaction with the Agency’s staff on all matters related to the security assessment project. We assign priority to all aspects of the Agency’s project and elevate the project’s visibility to the top executive level. The Agency’s IT Director, Network/IT Operations Lead, or other designated personnel will have the ability to directly address our management team any time there is a need for an executive decision. We also would appreciate periodic feedback concerning our team’s performance. We recommend scheduling periodic face-to-face meetings or teleconferences at this level.

Below the executive level, we will assign a Project Manager who will be the point of contact for all day-to-day activities covering contractual, staffing, management, and administration issues.

Bulletproof’s Response | July 19, 2024 Page 21

EXHIBIT 1: FOUR PHASE AUDIT APPROACH. BULLETPROOF USES A FORMALIZED STANDARD ASSESSMENT

METHODOLOGY

Phase 1 – Planning Bulletproof’s planning for the security assessment includes the development of a project management plan and appropriate assessment tools. This includes the following steps:

1. Development of the Security and Privacy Assessment Plan (SAP). Bulletproof develops a comprehensive assessment plan based on the requirements set out by CMS. The auditors determine the assessment cycle which includes the reviewing the following:

1. Control families in-scope for current year assessment cycle (see Appendix A – Annual Assessment MARS-E Controls)

2. Controls to be tested annually

3. Controls identified with weaknesses closed during the current year

4. Controls impacted by changes to the system environment during the current year

2. Project Planning: Based on scope and discussions with Client stakeholders regarding areas of concern to the organization, Bulletproof establishes project timeline, assigns resources, identifies key stakeholders and develops an initial schedule of interviews and meetings.

Bulletproof’s Response | July 19, 2024 Page 22

Bulletproof’s Planning Phase is consistent for any assessment cycle (i.e., Year 1, Year 2, Year 3 or a Full Assessment). Bulletproof will provide the Agency with the CMS required Security and Privacy Assessment Plan (SAP) that includes details of:

1. Planning and off-site assessment activities

2. On-site analysis (when applicable)

3. Analysis and documentation

4. Preliminary testing schedule

5. Test locations and Points of Contact

6. On-site requirements (when applicable)

7. Technical staff availability and requirements

Confirmation of the detailed SAP will be reviewed and verified with the Agency during the Planning Phase. Bulletproof will discuss the specific requirements of the assessment, identify specific systems, processes, procedures, define documents for review, verify and confirm stages of the assessment, confirm availability of personnel for assessment, verify time and timing of the assessment and final reporting and submission. The SAP will be submitted to CMS 30 days prior to the Agency of the assessment.

For a Full Assessment, to determine the potential security and privacy risks to the Agency, Bulletproof will complete a security and assessment workbook (SAW). of the E&E system. In accordance with the SAW, Bulletproof proposes to assess the following activities:

1. Review and evaluate the Administering Entity’s (AE) policies and procedures and attest to their implementation.

2. Interview key AE process owners to gather information on the implemented security and privacy controls to further assess the control environment.

3. Review the System Security Plan (SSP), including the security and privacy implementations, to verify the system information and control implementation documented is correct and updated, as necessary.

4. Review the Privacy Impact Assessment (PIA) and documentation to verify that privacy controls are documented, privacy risks are assessed, and control implementations have not changed.

5. Review the Plan of Actions and Milestones (POA&M) documentation to verify that there is a plan to implement controls not currently meeting the standard.

6. Review and test the Agency’s vulnerability management process.

Phase 2 – Assessment Bulletproof conducts the security evaluation which begins with a desktop review of the Security Management Organization and the security policies and procedures. This review allows our

Bulletproof’s Response | July 19, 2024 Page 23 assessment team to quickly assess your organizational security structure along with the overall management processes that have been established.

The objectives of this stage are to:

1. Review the security department’s management framework, security policies and procedures.

2. Collect necessary information for optimizing the assessment to focus on critical risk areas.

3. Review prior internal assessments and management review to identify areas of risk.

4. Confirm the assessment focus, schedule and plan logistics with State stakeholders to allow for an efficient and effective assessment.

This review includes interviews with key personnel and review of critical security management documentation and records.

The assessment phase includes the following steps:

1. Document review. Bulletproof performs a review of ACA security and privacy documentation which includes (but is not limited to):

1. Information Security Risk Assessment (ISRA)

2. System Security Plan (SSP) and supporting attachments

3. Contingency Plan (CP) and the Annual CP Test results

4. Privacy Impact Assessment (PIA)

5. Plan of Action and Milestones (POA&Ms)

6. CMS legal agreements:

1. Interconnection Security Agreement (ISA)

2. Computer Matching Agreement (CMA)

3. Information Exchange Agreement (IEA)

4. Other forms of agreements such as data use agreements

7. Documented security policies and procedures associated to control families.

8. Verification of records.

2. Identification of processes and interviews with processes owners. Bulletproof undertakes a site tour, which provides the opportunity to:

1. Assess the client's location and site-specific conditions and controls.

2. Meet agency/project personnel.

3. Observe technologies and facility security controls.

4. Conduct general observations of information security management operations.

5. Perform sampling as required

Bulletproof’s Response | July 19, 2024 Page 24

Bulletproof conducts interviews with key personnel to:

1. Validate security responsibilities and applicable legal, regulatory and contractual constraints.

2. Validate that internal audits and management reviews have been performed.

3. Identification and assessment of systems. A second stage review of the implemented security processes and controls to validate effectiveness is conducted. This review includes process observations, interviews, document review, analysis of records and process outputs, along with technical verification of configurations.

The objectives of this stage are to:

1. Validate information and evidence about conformity to all requirements of the applicable policy and process controls.

2. Validate monitoring, measuring, reporting and reviewing against key performance objectives.

3. Validate operational control of your organization’s processes.

4. Validate application of policy, any applicable legal requirements, responsibilities, competence of personnel, operations, procedures, performance data and internal assessment findings and conclusions.

4. Technical testing. Bulletproof conducts application and system security technical testing.

The technical testing will include (but not limited to) the following application and system tests:

1. Examination of the implemented access controls and identification and authorization techniques (e.g., log-on with easily-guessed/default passwords)

2. Tests to determine if the system is susceptible to cross-site scripting (XSS), structured query language (SQL) injection, and/or other commonly exploited vulnerabilities

3. Attempts to alter database management system settings

4. Attempts to access hidden URLs

5. Reviews of application-specific audit log configuration settings

6. Determination if sensitive information is encrypted before being passed between the system and browser

Network and Component scanning is performed to report on network and component infrastructure security posture. Network scans are performed on all in-scope network components to determine the extent to which the system control implementation meets security control requirements.

As part of this testing, Bulletproof will review configurations of implemented controls to determine if Administering Entity (AE) security requirements are implemented correctly. The assessor performs the following:

Bulletproof’s Response | July 19, 2024 Page 25

1. Reviews implemented configurations for each component against the AE security and privacy requirements

2. Reviews access to system and databases for default user accounts

3. Test firewalls, routers, systems, and databases for default configurations and user accounts

4. Reviews firewall access control rules against the AE security requirements

5. Determines consistency of system configuration with the AE-documented configuration

6. Determines if implemented controls match SSP defined requirements for example:

password length.

7. The SAR Technical Testing Section requires a greater level of detail, including metrics tables that are intended to help CMS quickly identify areas of technical risk.

Phase 3 – Analysis Bulletproof analyzes the results obtained during the assessment phase to identify recommendations and develop a suitable business strategy to improve security controls.

1. Complete analysis of findings. Bulletproof completes further in-depth investigation of the findings from the assessment phase and validate the risk analysis of the findings.

2. Develop recommendations for improvement. Based on the findings, Bulletproof develops security control recommendations to mitigate the risks identified in the assessment and prioritize the recommendations in terms of the time frame and costs required to implement the recommendations.

3. Review findings with the Agency. Prior to the reporting phase, Bulletproof reviews the findings with the client to ensure accuracy.

Phase 4 – Reporting Bulletproof’s reporting phase includes the following steps:

1. Develop draft report. Bulletproof documents observations and findings which resulted from the review and analysis of security processes into the Security and Privacy Assessment Workbook (SAW) and the Security and Privacy Assessment Report (SAR).

2. Collect management response from the Agency as required. Client management responses to Bulletproof’s preliminary findings are collected and incorporated into the final version of the report as required and if appropriate.

3. Complete final report. The final SAW and SAR reports including Management responses is presented to the Agency.

6.2.2 Proposed Tools

For this assessment, Bulletproof can conduct interviews and evidence collection remotely through email communication, telephone calls, or via video conferencing tools (such as Microsoft Teams or Zoom). In the case where any physical examinations or observations are

Bulletproof’s Response | July 19, 2024 Page 31

Previous Statements of Work

#DBDAS-24-06-005

Bulletproof’s Response | July 19, 2024 Page 32

Bulletproof’s Response | July 19, 2024 Page 33

Remainder of page intentionally left blank

Bulletproof’s Response | July 19, 2024 Page 44 provides a check point for CMS to identify any issues with the planned assessment ahead of time, rather than when the SAR is submitted.

2. Plan of Actions and Milestones (POA&M). Over the course of the project, we will work with the Agency to develop a Plan of Actions and Milestones (POA&M) up to the CMS standards required.

3. Security Assessment Report (SAR)

Upon completion of the assessment, the Agency receives a detailed Privacy and Security Assessment Report (SAR) compliant to MARS-E 2.0 standards and requirements and in the new 2021 format. The content of the report includes:

1. Executive Summary - The executive summary contains:

1. Provides a statement of compliance

2. Statement of security of the underlying infrastructure of the system

3. Statement of maintenance of data security

4. Verification of proper configuration of the database and file structure for storing data (applicable for full assessment)

5. Background – A high-level overview of what the system is and what sensitive data it processes

6. Assessment scope - to determine the potential security and privacy risks of the AE

7. Summary of findings – summary of all findings identified during the assessment

8. Summary of recommendations – recommendation of each finding for improvement that addresses the findings and the business systems risks

2. Assessment Methodology - A summary of the tools, tests and procedures followed during the course of the assessment.

3. Detailed Findings & Technical Testing Sections - The detailed findings section of the report contains:

1. Tests and analysis - Summary of the tests and analysis performed during the assessment

2. Technical testing tools - Summary of tools used to perform technical tasks

3. Business risk reporting - The business and systems risk level assessment value is assigned for each weakness identified

4. Business risk level assessment - Management, operational and technical vulnerabilities representing risks to the secure operations of the assessed systems are detailed as

Bulletproof’s Response | July 19, 2024 Page 48 experts come from direct security management roles. They’ve built their own security programs and understand the internal challenges faced by organizations – and how to solve them.

Our team has developed extensive expertise in conducting comprehensive security compliance reviews and analyses for multiple commercial and government clients. Our IT security specialists over the years perfected the process, the methodology, the tools, and the documentation that are required to perform the tasks of the scope and complexity similar to that of the Agency.

We are proud of our technical professionals and in our ability to attract highly skilled and dedicated professionals. This is achieved by creating a work environment conducive to personal career development, and by instituting a dynamic and efficient hiring process.

We hire highly experienced candidates with relevant educational background. Our screening process consists of multiple evaluation steps which extend beyond the hiring process well into the candidate tenure with our company:

1. Searching for candidates using commercial resume databases and personal referrals

2. Prescreening candidates over the phone

3. Multiple interviews (personnel, project manager, executives)

4. Background check (criminal and credit records, drug test when required by clients)

5. Initial Probation Period and formal Evaluation

6. Annual Employee Performance Evaluations

Our security experts hold certifications from and follow the industry leading frameworks of world-renowned organizations such as NIST, ISO/IEC, SANS Institute, ISACA and CERT. They have decades of experience assessing security controls and performing technical vulnerability assessments as well as consulting services related to clients’ IT infrastructure, information systems, and application security.

Our bench includes, among other certifications:

1. Certified Information Security Manager

(CISM)

2. Certified Information Systems Security Professional (CISSP)

3. GIAC Security Leadership (GSLC)

4. GIAC Strategic Planning, Policy, and Leadership (GSTRT)

5. ISO/IEC 27001 Lead Auditor

6. ISO/IEC 27701 Lead Auditor

7. CISA (Certified Information Systems Auditor)

9. GIAC Certified Incident Handler (GCIH)

10. GIAC Certified Perimeter Protection Analyst (GPPA)

11. CRISC (Certified in Risk and Information Systems Control)

12. OCTAVE Information Security Risk Evaluation

13. Certified Ethical Hacker (CEH)

14. Offensive Security Certified Professional

(OSCP)

Bulletproof’s Response | July 19, 2024 Page 49

8. Project Management Professional (PMP)

For the Agency’s assessment we will leverage our qualified auditors and technical assessors who have provided MARS-E assessment services to multiple AEs, and have direct experience with the new SAP and SAR requirements.

As can be observed from the proposed our team members’ resumes (see the following Resumes section), we assign only experienced and competent IT security professionals to perform on client tasks.

Our staff have earned multiple awards and certifications for technical competence and outstanding performance. Our awards are a credit to our staff’s perseverance and ability to get the job done right the first time.

We will use its streamlined management oversight methodology to ensure the success of this effort—from the executive level to the program/project level and down to the individual task assignments.

An executive corporate official, Gus Fritschie, will be assigned as Program Manager with overall responsibility for this contract. Reporting directly to this official will be the assigned Project Manager, Phillip Young. He will be charged with overseeing the completion of all tasks under this effort. Phillip will also create and maintain the project plan; work breakdown schedule and action plan for each task and will be responsible for all deliverables.

Phillip has served as Team Lead/Project Manager and the Senior IT Security Analyst for several large-scale projects, including a multi–year project with the Department of Education (ED) Office of the Inspector General (OIG) (project ran from 2014-2018). As it relates to this project, Phillip has led both projects with the State of Nevada (SSHIX and DHHS) as well as the Minnesota MNSure project, and the Wisconsin Department of Health Services project. He is also a seasoned Information Technology (IT) Auditor, experienced in performing Federal Information Security Modernization Act (FISMA) reviews.

Phillip will serve as a single point of contact (POC) for the Agency. Our team will establish reporting procedures to ensure coordination at all levels. We will utilize automated tools to track progress and produce reports detailing each activity under this contract in terms of milestones achieved, expended level of effort and unplanned dependencies (if any).

We will submit weekly progress reports identifying status of ongoing work, accomplishment of the past week and planned work for the week ahead. A log of interaction with the Agency’s staff will also be included as well as request for interviews and documentation.

We will submit meeting minutes for all progress and status meetings held with the Agency’s officials. Meeting notes will highlight any decision reached, agreements made or actions to be taken.

Throughout this effort, our team will maintain continuous interaction with the Agency’s personnel at multiple levels.

Bulletproof’s Response | July 19, 2024 Page 53

Resumes

AFFIRMATION AND DISCLOSURE FORM

Contractor affirms that Contractor has read and understands the applicable Executive Orders regarding the prohibitions of performance of offshore services, locating State data offshore in any way, or purchasing from Russian institutions or companies.

Contractor shall provide all the name(s) and location(s) where services under this Contract will be performed and where data is located in the spaces provided below or by attachment. Failure to provide this information may result in no award. If the Contractor will not be using subcontractors, indicate “Not Applicable” in the appropriate spaces.

1. Principal location of business of Contractor:

(Address) (City, State, Zip)

Name/Principal location of business of subcontractor(s):

(Name) (Address, City, State, Zip)

(Name) (Address, City, State, Zip)

2. Location where services will be performed by Contractor:

(Address) (City, State, Zip)

Name/Location where services will be performed by subcontractor(s):

(Name) (Address, City, State, Zip)

(Name) (Address, City, State, Zip)

Rev. 3/22 Page 1 of 2

3040 Williams Drive, Suite 510 Fairfax, VA 22031

N/A

3040 Williams Drive, Suite 510 Fairfax, VA 22031

N/A