Risk Management Terms (4.17.2026)~4.docx

31 KB Posted

Attached to
FY27_ITS86_Veterans Cemetery Digital Services Portal
Solicitation number
BD-27-1110-1110C-1110L-134139
Issued by
Suffolk County, Massachusetts

About this file

Written by GovTribe AI ·

This is a Risk Management Terms attachment issued by the Massachusetts Executive Office of Technology Services and Security (EOTSS) Office of Enterprise Risk Management that establishes mandatory cybersecurity and risk management requirements for all cloud solutions and services procured by the Commonwealth. The document outlines a comprehensive set of security obligations that cloud solution providers must meet or justify as inapplicable to their specific service offerings. These requirements apply to the FY27 Veterans Cemetery Digital Services Portal procurement and establish baseline expectations for cyber security posture, incident response capabilities, and data protection practices. Vendors are required to provide detailed responses explaining how their proposed solutions comply with each term or provide documented justification for any exceptions. The terms may be negotiated between the Commonwealth and vendors but take precedence over any conflicting vendor-provided terms.

The Risk Management Terms encompass 23 specific security and operational requirements covering penetration testing, incident response programs, security lifecycle management, subcontractor evaluation, workforce security awareness, network monitoring, disaster recovery, and data backup procedures. Key requirements include annual penetration testing with vulnerability remediation, off-site backup of agency data in hardened United States facilities with maximum twelve-hour recovery time objective, multi-factor authentication for remote and administrative access, continuous vulnerability assessment, comprehensive audit logging, secure configuration management, and regular disaster recovery testing at minimum twice annually. Vendors may satisfy assessment requirements by providing copies of recent third-party audits such as SOC2 or PCI-DSS certifications. All inquiries regarding these terms or the sufficiency of vendor responses should be directed to the Office of Enterprise Risk Management at ERM@mass.gov.

View the file

Other files

File Type Posted
Vendor-Digital-Accessibility-Questionnaire-v01~6.pdf PDF
Terms and Conditions IT~1.pdf PDF
Cloud Terms (4.17.2026).docx DOCX document
SOW - Fixed Price (8.13.2026) (1)~5.docx DOCX document
ITS86_Veterans Cemetery Digital Services Portal~8.pdf PDF
Digital-Accessibility-Roadmap-Template-v01~4.xlsx XLSX spreadsheet

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file
Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

ATTACHMENT XX

RISK MANAGEMENT TERMS

The following terms are issued by EOTSS’ Office of Enterprise Risk Management and shall apply to Cloud Solutions, which may include software and services, purchased by the Commonwealth. The Office of Enterprise Risk Management is issuing the following terms to improve the cyber security posture of the Commonwealth and to ensure adequate risk management controls are implemented by the Commonwealth’s contractors.

Vendor (or “Cloud Solution Provider”) must provide a response indicating the manner in which the proposed Cloud Solutions meet each term, or provide justification as to why a term is not applicable to the offered services. These terms may be negotiated between the Commonwealth and the vendor and shall take precedence over any conflicting terms provided by the vendor. Any questions regarding the following terms or the sufficiency of the responses should be directed to the Office of Enterprise Risk Management, ERM@mass.gov. To fulfill this requirement, the cloud service provider may share a copy of any recent systems audits (SOC2, PCI-DSS, etc.) completed by third-party service providers in lieu of completing the assessment.

Vendor Name:

Contact Info: Name:_____________________________Email:______________________

Category
Term
Vendor’s Response
Risk Management
Cloud Solution Provider shall perform annual penetration testing of its application and/or system and shall remediate the vulnerabilities and confirm that corrective measures have been implemented in a manner that prevents exploitation identified during the penetration testing.
Risk Management
Cloud Solution Provider shall establish a program to develop and maintain an incident response capability to prepare, detect and immediately respond to an attack.
Risk Management
Cloud Solution Provider shall manage the security life cycle of any application and/or system it has developed, acquired or is hosting, to prevent, detect and remediate security weaknesses before they can impact the Agency.
Risk Management
Cloud Solution Provider will evaluate subcontractors and other service providers who will hold Agency data to ensure that such subcontractors and providers are protecting the Agency data in accordance with Cloud Solution Provider’s obligations to Agency.
Risk Management
Cloud Solution Provider shall maintain a security awareness program to influence behavior among its workforce to be security conscious and properly skilled to reduce cybersecurity risks to the Cloud Solution Provider.
Risk Management
Cloud Solution Provider shall operate processes and tooling to establish and maintain comprehensive network monitoring of its assets and defense against security threats across its applications and systems.
Risk Management
Cloud Solution Provider shall establish, implement, and actively manage (monitor, track, report and correct) its network devices in order to prevent attacks from exploiting any vulnerabilities in its network services and access points.
Risk Management
Cloud Solution Provider will establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-incident and trusted state.
Risk Management
Cloud Solution Provider shall review and test the disaster recovery plan regularly, at minimum twice annually. Cloud Solution Provider shall back up Agency Data in an off-site “hardened” facility located within the United States. In the event of service failure, Cloud Solution Provider shall be able to restore the Cloud Solution, including Agency Data, with loss of no more than twelve (12) hours of Agency Data and transactions prior to failure.
Risk Management
Cloud Solution Provider shall actively work on improving protections and detections of threats from email and web actors trying to manipulate human behavior through direct engagement.
Risk Management
Cloud Solution Provider shall collect, alert, review and retain audit logs of events that may help detect, understand or recover from an attack.
Risk Management
Cloud Solution Provider shall have a plan to continuously assess and track vulnerabilities of its assets within its infrastructure.
Risk Management
Cloud Solution Provider shall use processes and tools to create, assign, manage and revoke access credentials and privileges for user, administrator, and service accounts for its assets and software.
Risk Management
Cloud Solution Provider will use processes and tools to ensure that access to the Cloud Solution is restricted to users with the correct credentials for the applicable user accounts.
Risk Management
Cloud Solution Provider shall establish and maintain a secure configuration of its assets and software.
Risk Management
Cloud Solution Provider will develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data.
Risk Management
Cloud Solution Provider shall actively manage, through inventorying, tracking and correcting, all of its assets connected to its infrastructure physically, virtually, remotely and those within its cloud environments to accurately know the totality of its assets that need to be monitored and protected.
Risk Management
Cloud Solution Provider shall actively manage, through inventorying, tracking and correcting, all software on its network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.
Risk Management
Cloud Solution Provider shall provide Agency with access to a console or other mechanism for tracking entitlements and deployments of the Solution within Agency’s environment. Cloud Solution Provider will enable Agency to centrally manage updates or upgrades to all deployments from the console.
Risk Management
Cloud Solution Provider shall implement Multi Factor Authentication (MFA) for remote and admin access.
Risk Management
Cloud Solution Provider shall promptly replace end of life systems and applications.

File details come from the government source that posted it. Updated .