RFx Cybersecurity Requirements.pdf

RFx Cybersecurity Requirements

Document Name: RFx Cybersecurity Requirements

Document ID: IS.004 Version: 1.00

Policy Owner: Ty Smith, Chief Information Security Officer

Effective Date: 01/16/2026 Last Revised Date: 01/16/2026

TABLE OF CONTENTS

1. Introduction

2. Requirement Statements A. Enterprise Information Security Policies B. Security Frameworks and Standards C. Data Classification D. Data Ownership E. Data Storage and Services F. Data Protection G. Access Management H. Security Incident Detection and Response I. Data Breach Reporting and Notification J. Data Breach Responsibilities K. Data Handling Upon Termination L. Security Training M. Compliance and Audit Rights

1. Introduction

The Massachusetts Judicial Branch (Judiciary) is committed to maintaining the highest standards of cybersecurity and data protection to safeguard sensitive judicial information (used interchangeably with “data”), protect the privacy of all users, and ensure the confidentiality, integrity, and availability of its information assets. Vendors responding to this RFx – where x may stand for “information”, “proposals”, or “quotes” – must describe how their proposed services, systems, and/or software adhere to the requirements outlined below.

2. Requirement Statements

A. Enterprise Information Security Policies

a. All products and services provided to the Judiciary must comply with all applicable policies adopted by the Judiciary, which shall be made available to Bidder prior to contract execution.

b. At a minimum, all goods and services provided to the Judiciary must comply with the Enterprise Information Security Policies as documented by the Massachusetts Executive Office of Technology Services and Security (EOTSS) (https://www.mass.gov/handbook/enterprise-information-security-policies).

c. Bidders shall provide information that demonstrates that their security practices meet the requirements detailed in these policies.

B. Security Frameworks and Standards

a. Vendors must demonstrate compliance or alignment with one or more of the following recognized security frameworks and standards:

i. Center for Internet Security (CIS) Critical Security Controls (v8 or later).

ii. National Institute of Standards and Technology (NIST) Special Publications, including 800-53 and 800-171.

https://www.mass.gov/handbook/enterprise-information-security-policies

iii. NIST Cybersecurity Framework (CSF) functions: Identify, Protect, Detect, Respond, and Recover.

iv. MITRE ATT&CK Framework for threat identification and mitigation.

C. Data Classification

a. The Judiciary collects, stores, accesses, distributes, and destructs data to support its business operations. Such information assets may include, without limitation, personal information, confidential information, and information protected under applicable law.

b. Bidder agrees and acknowledges that its access, or potential access, to certain information assets may require certifications, background checks, or other additional requirements.

c. Purchasing Entity anticipates that the awarded Bidder will have access, or potential access, to the following checked data types as a result of providing services/products to Purchasing Entity under this RFx.

Data Type (mark Y for all that apply or N for those that do not)

Applicable Laws and Regulations

Additional Requirements

Y Personally Identifiable Information (PII)

M.G.L. c. 93H M. G. L. c. 66A

N Payment Card Information PCI Standards N Family Educational Rights and Privacy Act data Family Educational Rights and Privacy Act

Y Protected Health Information (PHI)

Health Insurance Portability and Accountability Act of

-Commonwealth of Massachusetts Executive Office of Health and Human Services Data Management and Confidentiality Agreement

N Federal Tax Return Information

Publication 1075 -Publication 1075 Exhibit 7 -Commonwealth of Massachusetts Dept. of Revenue background check

N Criminal Offender Record Information

FBI Security Addendum NCIC 2000 Operating Manual CJIS Security Policy Title 28, CFR Part 20

-Dept. of Criminal Justice Information certification -background check

N Criminal Justice Information

FBI Security Addendum NCIC 2000 Operating Manual CJIS Security Policy Title 28, CFR Part 20

-Dept. of Criminal Justice Information certification -background check

N Social Security Administration Data

Privacy Act 5 U.S.C. 552a s. 1106

N Other

d. Bidder certifies that its products or services, as offered in its RFx proposal, meet all applicable legal and regulatory requirements pertaining to the identified data types indicated above.

e. Bidder also agrees to enter into additional agreement(s), as reasonably requested by the Judiciary prior to gaining access, or potential access, to information assets.

f. Bidder acknowledges that the list above is not exhaustive, and Purchasing Entity may designate additional data types, applicable laws and regulations, and additional required documentation in the contract resulting from this RFx or any amendment thereto.

D. Data Ownership

a. The Judiciary will own all rights, titles, and interest in its data.

b. The Bidder shall not collect, store, access, distribute, or destruct user-specific Judiciary data except as strictly necessary to provide this service to the Judiciary.

c. No information regarding the Judiciary’s use of the service may be disclosed, provided, rented, or sold to any third-party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. This obligation shall survive and extend beyond the term of this RFx.

E. Data Storage and Services

a. All systems hosting or storing Judiciary data must reside solely within data centers in the United States compliant with Federal Risk and Authorization Management Program (FedRAMP) Moderate or higher standards, or equivalent state-level certifications.

b. The Bidder shall provide its services solely from data centers physically located in the United States.

c. The Bidder must maintain an up-to-date list of authorized personnel with access to Judiciary data and immediately revoke access upon termination or role change.

d. The Bidder shall not allow its personnel or contractors to store data on portable devices, including personal computers and mobile phones, except for devices that are used and kept only at its United States data centers.

e. The Bidder shall permit its personnel and contractors to access Judiciary data remotely only within the United States as required to provide support for its services.

f. Cloud providers must have documented SOC 2 Type II and ISO 27001 certifications.

g. The Bidder must provide clear documentation on data redundancy, geographic failover, and disaster recovery plans.

F. Data Protection

a. Protection of data shall be an integral part of the Bidder’s business activities to ensure there is no inappropriate or unauthorized use of the data provided to the Bidder.

b. The Bidder shall implement and maintain appropriate administrative, technical, and organizational security measures to safeguard against unauthorized access, disclosure, or theft of data. Such security measures shall be in accordance with recognized industry best practices.

c. The Bidder shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules, unless the Judiciary approves in writing for the storage of data on a Bidder’s portable device in order to accomplish work as https://csrc.nist.gov/pubs/fips/140-2/upd2/final https://csrc.nist.gov/pubs/fips/140-2/upd2/final defined in the RFx.

d. All data, including audio, video, and metadata, must be encrypted both in transit and at rest using current industry standards (ex. AES-256, TLS 1.2+) with controlled access. The Bidder is responsible for encryption of all Judiciary data that it handles in its possession.

e. The Bidder must specify how encryption keys are generated, stored, and rotated.

f. Access to sensitive data must require multi-factor authentication (MFA) and role-based access controls (RBAC).

g. At no time shall any information or processes — that either belong to or are intended for the use of the Judiciary — be copied, disclosed, or retained by the Bidder or any party related to the Bidder for subsequent use in any transaction that does not include the Judiciary.

h. The Bidder shall not use any information collected in connection with the services provided pursuant to this RFx for any purpose other than fulfilling the services.

i. The Bidder shall not use any Judiciary data for use as training for any artificial intelligence platform without consent and approval by the Judiciary.

G. Access Management

a. Technical Requirements

i. The technical requirements for the solution’s software must be supported as delivered (e.g., out of the box).

ii. Information pertaining to any user accounts shall be continuously updated by the Judiciary via a Microsoft Entra sync to the vendor’s platform for this solution via system for cross-domain identity management (SCIM) provisioning. For useability access, this will allow for single sign-on (SSO) using existing Entra ID account credentials to log in to existing Judiciary tool, services, and resources.

From a cybersecurity perspective, SSO will allow for account monitoring for all activity, including suspicious activity requiring investigation and/or remediation.

iii. A Vendor may determine that it cannot respond to this technical requirement as described in this RFx but may believe it can offer equivalent or superior performance by some other means. In such cases, the Vendor should explicitly state that it cannot meet the specification as presented, propose an alternative and provide a thorough description of how the proposed alternative would provide the equivalent or superior performance of the specification. The Evaluation Committee will be the sole judge of whether a proposed alternative achieves at least an equivalent performance of the technical or business specification the Vendor is identifying an alternative for.

H. Security Incident Detection and Response

a. The Bidder must have formalized incident detection, response, and notification procedures that align with NIST SP 800-61 Rev. 3.

b. Vendors must support integration with the Judiciary’s monitoring and alerting tools, including Splunk and CrowdStrike Falcon, to provide real-time visibility and event correlation.

c. If Bidder knows or has reason to know of a security incident or data breach that may impact the Judiciary and its data, Bidder shall notify the Judiciary as soon as practicable from the date of the security incident or data breach, and in no event more than 24 hours after discovery and shall cooperate with the Judiciary to meet any requirements under applicable state or federal law(s).

d. In the event of a security incident or data breach, Bidder will take commercially reasonable steps to mitigate the effects, to resolve the security incident or data breach in a timely manner, and to put measures in place to prevent the reoccurrence of similar security incidents or breaches in the future.

I. Data Breach Reporting and Notification

a. If requested by the Judiciary or if required by applicable state or federal law(s) (including without limitation Massachusetts General Laws, chapter 93H), Bidder will provide notice as soon as practicable to those individuals who data was affected or may have been affected by a security incident or data breach. If the security incident or data breach is due to the negligence of the Bidder, Bidder shall provide all requested and/or required notices at its sole expense.

J. Data Breach Responsibilities

a. The Bidder shall immediately notify the appropriate Judiciary identified contact (Contract Manager) by telephone, if it reasonably believes there has been a security incident.

b. The Bidder, unless stipulated otherwise, shall promptly notify the appropriate Judiciary-identified contact (Contract Manager) within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it has confirmed that there is, or reasonably believes that there has been a data breach. The Bidder shall (1) cooperate with the Judiciary, as reasonably requested, to investigate and resolve the data breach, (2) promptly implement necessary remedial measures, and (3) document responsive actions taken related to the data breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.

c. If a data breach is a direct result of Bidder’s breach of its contractual obligation to encrypt all data or otherwise prevent its release, the Bidder shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators, or others required by state and federal law(s); (3) a credit monitoring service; (4) a website or a toll-free number and call center for affected individuals required by state and federal law(s) — all not to exceed the average per record per person cost calculated for data breaches in the United States in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Bidder based on root cause.

K. Data Handling Upon Termination

a. The Bidder must define data retention schedules that comply with the Judiciary’s records management policies and Massachusetts public records retention laws.

b. Upon termination of any resulting contract, the Bidder shall securely dispose of all Judiciary data in all its forms. Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology approved methods.

c. Secure deletion methods (ex. NIST SP 800-88) must be used when decommissioning or migrating data.

d. Certificates of destruction must be provided to the Judiciary upon request.

L. Security Training

a. The Bidder must have its staff and contractors with access to Judiciary systems or data complete annual cybersecurity awareness training provided by the Judiciary or equivalent training, as approved by the Judiciary, on an annual basis.

M. Compliance and Audit Rights

a. The Judiciary, in coordination with EOTSS or authorized third-party assessors, reserves the right to audit the Bidder’s security controls, configurations, and logs to ensure compliance with contractual and legal obligations.

b. The Bidder must provide detailed responses regarding any past or ongoing security incidents, data breaches, or regulatory non-compliance within the last five (5) years.