RFP 24RFP9840_Exhibit F.docx

Exhibit F Security and Vendor Questions Basic Vendor Information Vendor Legal Name:

Vendor Address:

Directions Agencies: The following questions facilitate agencies acquiring technology that meets state security standards. These questions will assist in improving the quality and the timeliness of the procurement. The Bureau of Information and Telecommunications (BIT) recommends that you utilize your BIT Point of Contact (POC) to set up a planning meeting to review the project and these questions. Understanding the background and context of the questions greatly improves realizing the purpose of the questions. Again, the purpose of the questions is to ensure the product/service being procured will meet the technology and security standards of the state.

If you do not know the details of the technologies the vendor will propose, it is best to keep the question set as broad as possible. If there is a detailed knowledge of what will be proposed, a narrowed set of questions may be possible. Vendors are invited to mark any question that does not apply to their technology as NA (Not Applicable).

Vendors: The following questions help the State determine the best way to assess and integrate your product or service technology with the State’s technology infrastructure. Your response to the questions allows BIT an opportunity to review the security of your product, and helps BIT make an informed decision and recommendation regarding your technology or service. Some questions may not apply to the technology you use. In such cases, simply mark the question as NA (Not Applicable). The questions are divided into sections to help identify the point of the questions.

The State understands that some of the information you may provide when answering the questions is considered confidential or proprietary. Please mark which answers you deem to be confidential/proprietary information. Access to this confidential information will be limited to those state employees who have a need to know. In addition, the State will maintain the confidentiality of the marked information, and the marked information may be exempt from disclosure to the public per the State’s Open Records Laws.

Use the last column as needed to explain your response. Also note, many questions require you to explain your response. The more detailed the response, the better we can understand your product or service.

Where we feel that a Yes/No/NA response is not appropriate, the cell has been grayed out. If the vendor answers a question by referencing another document or another part of the RFP response, the vendor must provide the page number and paragraph where the information can be found.

The “BIT” column corresponds to the division within BIT that will be the primary reviewers. If you have questions about the meaning or intent of a question, we can contact the BIT division on your behalf. DC = Data Center; DEV = Development; TEL = Telecommunications; POC = Point of Contact.

System/Product:

The following questions are relevant for all vendors or third parties engaged in this hardware, software, application, or service.

Response

DEV

☐ Vendor Hosted ☐ Other: (Please state)

DEV

TEL

TEL

☐ No

If “Yes”, please describe how email will be used:

POC

TEL

Will there be any desktop software installs, policies, or software required on state managed computers as part of this product?

☐ Yes

If “Yes”, please define:

Please provide link below, if applicable:

☐ Microsoft Windows 11 ☐ Other (please specify):

☐ Not Applicable

December 2023 Section A. System Security

The following questions are relevant for all vendors or third parties engaged in this hardware, application, or service and pertain to relevant security practices and procedures.

Response

x Does the solution require user authentication, and does that authentication solution support OpenID Connect or OAUTH2 to provide single sign-on? Please explain the authentication protocol(s) available to meet the State’s single sign-on requirements and how that is implemented with one or more identity providers.

TEL

Will the system provide internet security functionality on public portals using encrypted network/secure socket layer connections in line with current recommendations of the Open Web Application Security Project (OWASP)?

TEL

Does the application contain mitigations for risks associated to uncontrolled login attempts (response latency, re-Captcha, lockout, IP filtering, multi-factor authentication)? Which mitigations are in place? What are the optional mitigations?

Are account credentials hashed and encrypted when stored? If “Yes” please describe the encryption used (e.g. SHA256).

TEL

x The protection of the State’s system and data is of upmost importance. Web Application Vulnerability Scans must be done if:

· An application will be placed on the State’s system.

· The State’s system connects to another system.

· The contractor hosts State data.

· The contractor has another party host State data the State will want to scan that party.

The State would want to scan a test system; not a production system and will not do penetration testing. The scanning will be done with industry standard tools. Scanning would also take place annually as well as when there are code changes. Will you allow the State to scan a test system? If no, please explain or provide an alternative option to ensure protection of the State’s system and data.

Will organizations other than the State of South Dakota have access to our data?

Do you have developers that possess software security related certifications (e.g., the SANS secure coding certifications)?

Are static or dynamic software security analysis tools used to identify weaknesses in the software that can lead to exploitable vulnerabilities? If yes, which tools are used? What classes of weaknesses are covered? When in the SDLC are these scans performed? Are SwA experts involved in the analysis of the scan results?

TEL

Has the product undergone any vulnerability or penetration testing? If yes, how frequently, by whom, and are the test reports available under a nondisclosure agreement? How have the findings been mitigated?

Do you have an automated Security Information and Event Management system?

What types of event logs do you keep and how long do you keep them?

a. System events

b. Application events

c. Authentication events

d. Physical access to your data center(s)

e. Code changes

f. Other:

b. If yes, how frequently are the tests performed?

What are your procedures for intrusion detection, incident response, and incident investigation and escalation?

Do you have a BYOD policy that allows your staff to put any sort of sensitive or legally protected State data on their device personal device(s) or other non-company owned system(s)?

Do you require multifactor authentication be used by employees and subcontractors who have potential access to legally protected State data or administrative control? If yes, please explain your practices on multifactor authentication including the authentication level used as defined in NIST 800-63 in your explanation. If no, do you plan on implementing multifactor authentication? If so, when?

DEV

POC

Will the system provide data encryption for sensitive or legally protected information both at rest and transmission? If yes, please provide details.

b. Is the audit performed annually?

c. When was the last audit performed?

d. If it is SOC 2 audit report, does it cover all 5 of the trust principles?

e. If it is a SOC 2 audit report, what level is it?

f. Does the audit include cloud service providers?

g. Has the auditor always been able to attest to an acceptable audit result?

h. Will you provide a copy of your latest SOC 2 or ISO 27001 audit report upon request? A redacted version is acceptable.

Are you providing a device or software that can be defined as being Internet of Thing (IoT)? Examples include IP camera, network printer, or connected medical device. If yes, what is your process for ensuring the software on your IoT devices that are connected to the state’s system, either permanently or intermittently, are maintained and/or updated?

(Only to be used when medical devices are being acquired.) Please give the history of cybersecurity advisories issued by you for your medical devices. Include the device, date, and the nature of the cybersecurity advisory.

POC

Does any product you propose to use or provide the State include software, hardware, or hardware components manufactured by any company on the federal government’s Entity List?

Section B. Hosting The following questions are relevant to any hosted applications, systems, databases, services, and any other technology. The responses should not assume a specific hosting platform, technology, or service but instead the response should address any hosting options available for the proposed solution.

For state-hosted systems that reside in a state-managed cloud:

To minimize impacts to project schedules, vendors are required to provide architectural plans, resource needs, permission plans, and all interfaces – both internal to the state and internet facing for cloud hosted systems. The documentation provided will be reviewed as part of the initial assessment process. If selected for award of a contract, and once the state has approved the submitted materials, a test environment will be provided after contract signature. Systems will be reviewed again before being moved to a production environment. Any usage or processes that are deemed out of compliance with what was approved or represent excessive consumption or risk will require remediation before being moved to production.

Response

DEV

POC

Do you have a formal disaster recovery plan? Please explain what actions will be taken to recover from a disaster. Are warm or hot backups available? What are the Recovery Time Objectives and Recovery Point Objectives?

DEV

TEL

If any cloud services are provided by a third-party, do you have contractual requirements with them dealing with:

· Security for their I/T systems;

· Staff vetting;

· Staff security training?

a. If yes, summarize the contractual requirements.

b. If yes, how do you evaluate the third-party’s adherence to the contractual requirements?

b. Do you test after the system was stood up to make sure everything in the checklist was correctly set?

Do you use Content Threat Removal to extract and transform data?

Does your company have an endpoint detection and response policy?

Does your company have any real-time security auditing processes?

What anti-malware product(s) do you use?

What is your process to implement new vendor patches as they are released and what is the average time it takes to deploy a patch?

Have you ever had a data breach? If so, provide information on the breach.

What is your process for ensuring the software on your IoT devices that are connected to your system, either permanently or intermittently, is maintained and updated?

Section C: Database The following questions are relevant to any application or service that stores data, irrespective of the application being hosted by the state or the vendor.

Response

DEV

Will the system infrastructure include a separate OLTP or Data Warehouse Implementation?

Will the system infrastructure require a Business Intelligence solution?

Section D: Contractor Process The following questions are relevant for all vendors or third parties engaged in providing this hardware, application, or service and pertain to business practices. If the application is hosted by the vendor or the vendor supplies cloud services those questions dealing with installation or support of applications on the State’s system can be marked “NA”.

Response

Will the vendor provide assistance with installation?

DEV

POC

Does your company have a policy and process for supporting/requiring professional certifications? If so, how do you ensure certifications are valid and up-to date?

a. Is there a Support Lifecycle Policy within the organization for the software

b. Does it outline and establish a consistent and predictable support timeline?

a. Can patches and service packs be uninstalled?

b. Are the procedures for uninstalling a patch or service pack automated or manual?

How are enhancement requests and reports of defects, vulnerabilities, and security incidents involving the software collected, tracked, prioritized, and reported? Is the management and reporting policy available for review?

b. Does it identify options that should not normally be used because they create security weaknesses?

b. Has your company identified specific statistical and/or qualitative analytical techniques for measuring attainment of security measures?

b. What are your rollback procedures in the event of problems resulting from installing a patch or service pack?

How is endpoint protection done? For example, is virus prevention used and how are detection, correction, and updates handled?

Do you perform regular reviews of system and network logs for security issues?

What technical, installation, and user documentation do you provide to the State? Is the documentation electronically available and can it be printed?

DEV

a. Will the implementation plan include user acceptance testing?

b. If yes, what were the test cases?

c. Do you do software assurance?

DEV

POC

Will the implementation plan include performance testing?

Will there be documented test cases for future releases including any customizations done for the State of South Dakota?

If the State of South Dakota will gain ownership of the software, does the proposal include a knowledge transfer plan?

Has your company ever conducted a project where your product was load tested?

DEV

Does your company have corporate policies and management controls in place to ensure that only corporate-approved (licensed and vetted) software components are used during the development process? Provide a brief explanation. Will the supplier indemnify the acquirer from these issues in the license agreement? Provide a brief explanation.

b. If yes, are those components scanned by a static code analysis tool?

DEV

What security design and security architecture documents are prepared as part of the SDLC process? How are they maintained? Are they available to/for review?

How are trouble tickets submitted? How are support issues, specifically those that are security-related escalated?

Please describe the scope and give an overview of the content of the security training you require of your staff, include how often the training is given and to whom. Include training specifically given to your developers on secure development.

TEL

It is State policy that all Contractor Remote Access to systems for support and maintenance on the State Network will only be allowed through Citrix Netscaler. Would this affect the implementation of the system?

TEL

Contractors are also expected to reply to follow-up questions in response to the answers they provided to the security questions. At the State’s discretion, a contractor’s answers to the follow-up questions may be required in writing and/or verbally. The answers provided may be used as part of the contractor selection criteria. Is this acceptable?

DEV

POC

TEL

x (For PHI only)

a. Have you done a risk assessment? If yes, will you share it?

b. If you have not done a risk assessment, when are you planning on doing one?

c. If you have not done a risk assessment, would you be willing to do one for this project?

Will your website conform to the requirements of Section 508 of the Rehabilitation Act of 1973?

Section E: Software Development The following questions are relevant to the tools and third-party components used to develop your application, irrespective of the application being hosted by the State or the vendor.

Response

POC

What are the development technologies used for this system?

If marked yes, indicate version.

ASP.Net

VB.Net

C#.Net

.NET Framework

Java/JSP

MS SQL

Other

Is this a browser-based user interface?

Will the system have any workflow requirements?

Will your system use Adobe Air, Adobe Flash, Adobe ColdFusion, Apache Flex, Microsoft Silverlight, PHP, Perl, Magento, or QuickTime? If yes, explain?

Has your company ever integrated this product with an enterprise service bus to exchange data between diverse computing platforms?

b. If yes, please list those third-party application(s) or system(s).

b. Will the system infrastructure require an interface into the State’s email infrastructure?

c. Will the system involve the use of bulk email distribution to State users? Client users? In what quantity will emails be sent, and how frequently?

a. Does your application use any Oracle products?

b. If yes, what product(s) and version(s)?

c. Do you have support agreements for these products?

b. Is it designed to isolate and minimize the extent of damage possible by a successful attack?

a. Common Vulnerabilities and Exposures (CVE) database?

b. Open Web Application Security Project (OWASP) Top Ten?

F. Infrastructure The following questions are relevant to how your system interacts with the State’s technology infrastructure. If the proposed technology does not interact with the State’s system, the questions can be marked “NA”.

Response

Will the network communications meet Institute of Electrical and Electronics Engineers (IEEE) standard TCP/IP (IPv4, IPv6) and use either standard ports or State-defined ports as the State determines?

It is State policy that all systems must be compatible with BIT’s dynamic IP addressing solution (DHCP). Would this affect the implementation of the system?

It is State policy that all software must be able to use either standard Internet Protocol ports or Ports as defined by the State of South Dakota BIT Network Technologies. Would this affect the implementation of the system? If yes, explain.

The State has a virtualize first policy that requires all new systems to be configured as virtual machines. Would this affect the implementation of the system? If yes, explain.

It is State policy that all access from outside of the State of South Dakota’s private network will be limited to set ports as defined by the State and all traffic leaving or entering the State network will be monitored. Would this affect the implementation of the system? If yes, explain.

It is State policy that systems must not use dynamic Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) ports unless the system is a well-known one that is state firewall supported (FTP, TELNET, HTTP, SSH, etc.). Would this affect the implementation of the system? If yes, explain.

Please describe the types and levels of network access your system/application will require. This should include, but not be limited to TCP/UDP ports used, protocols used, source and destination networks, traffic flow directions, who initiates traffic flow, whether connections are encrypted or not, and types of encryption used. The Contractor should specify what access requirements are for user access to the system and what requirements are for any system level processes. The Contractor should describe all requirements in detail and provide full documentation as to the necessity of the requested access.

List any hardware or software you propose to use that is not State standard, the standards can be found at: https://bit.sd.gov/bit?id=bit_standards_overview.

Will the system provide an archival solution? If not, is the State expected to develop a customized archival solution?

Provide a system diagram to include the components of the system, description of the component, and how the components communicate with each other.

It is State policy that no equipment can be connected to State Network without direct approval of BIT Network Technologies. Would this affect the implementation of the system?

x Will the server-based software support:

a. Windows server 2016 or higher

b. IIS7.5 or higher

c. MS SQL Server 2016 standard edition or higher

d. Exchange 2016 or higher

e. Citrix XenApp 7.15 or higher

f. VMWare ESXi 6.5 or higher

g. MS Windows Updates

h. Windows Defender

All network systems must operate within the current configurations of the State of South Dakota’s firewalls, switches, IDS/IPS, and desktop security infrastructure. Would this affect the implementation of the system?

The State implements enterprise-wide anti-virus solutions on all servers and workstations as well as controls the roll outs of any and all Microsoft patches based on level of criticality. Do you have any concerns regarding this process?

What physical access do you require to work on hardware?

Section G: Business Process The following questions pertain to how your business model interacts with the State’s policies, procedures, and practices. If the vendor is hosting the application or providing cloud services, questions dealing with installation or support of applications on the State’s system can be marked “NA”.

Response

b. If so, will you provide copies of the licenses with a line-item list of their proposed costs before they are finalized?

DEV

Is on-site assistance available? If so, what is the charge?

a. Will you provide customization of the system if required by the State of South Dakota?

b. If yes, are there any additional costs for the customization?

Are help desk or support center personnel internal company resources or are these services outsourced to third parties? Where are these resources located?

POC

Will this application now or possibly in the future share PHI with other entities on other networks, be sold to another party, or be accessed by anyone outside the US?

Is telephone assistance available for both installation and use? If yes, are there any additional charges?

What do you see as the most important security threats your industry faces?