Schedule C - RFP 19-2164.docx

DRAFT

SCHEDULE C

Data Security Requirements

1. Definitions:

“FedRAMP” means the Federal Risk and Authorization Management Program, which is a federally approved risk management program that provides a standardized approach for assessing and monitoring the security of cloud products and services.

“Hosted Services” means the hosting, management and operation of the computing hardware, ancillary equipment, Software, firmware, data, other services (including support services), and related resources for remote electronic access and use by the State and its Authorized Users.

“NIST” means the National Institute of Standards and Technology.

“PSP” means the State’s IT Policies, Standards and Procedures located at:

http://michigan.gov/dtmb/0,4568,7-150-56355_56579_56755---,00.html.

Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Contractor Systems who has sufficient knowledge of the security of the Contractor Systems and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”). The Contractor Security Officer will be considered Key Personnel under the Contract.

Protection of the State’s Confidential Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

maintain FedRAMP certification for the Hosted Services throughout the Term, and in the event the contractor is unable to maintain FedRAMP certification, the State may move the Software to an alternative provider, at contractor’s sole cost and expense;

ensure that the Software is securely hosted, supported, administered, and accessed in a data center that resides in the continental United States, and minimally meets Uptime Institute Tier 3 standards (www.uptimeinstitute.com), or its equivalent;

maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State’s Confidential Information that comply with the requirements of the State’s data security policies as set forth in the Contract, and must, at a minimum, remain compliant with the NIST Special Publication 800.53 (most recent version) MOD Controls using minimum control values as established in the applicable PSP;

provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the processing of the State’s Confidential Information and the nature of such Confidential Information, consistent with best industry practice and standards;

take all reasonable measures to:

secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Services against “hackers” and others who may seek, without authorization, to disrupt, damage, modify, access or otherwise use Contractor Systems or the information found therein; and prevent (i) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Services; (ii) the State’s Confidential Information from being commingled with or contaminated by the data of other customers or their users of the Services; and (iii) unauthorized access to any of the State’s Confidential Information;

State Data must be encrypted in transit and at rest using AES 256bit or higher encryption;

The Hosted Services must support Identity Federation/Single Sign-on (SSO) capabilities using Security Assertion Markup Language (SAML) or comparable mechanisms; and The Hosted Services must have multi-factor authentication for privileged/administrative access.

assist the State, at no additional cost, with development and completion of a system security plan using the State’s automated governance, risk and compliance (GRC) platform.

Unauthorized Access. Contractor may not access, and shall not permit any access to, State systems, in whole or in part, whether through Contractor’s Systems or otherwise, without the State’s express prior written authorization. Such authorization may be revoked by the State in writing at any time in its sole discretion. Any access to State systems must be solely in accordance with the Contract and this Schedule, and in no case exceed the scope of the State’s authorization pursuant to this Section 4. All State-authorized connectivity or attempted connectivity to State systems shall be only through the State’s security gateways and firewalls and in compliance with the State’s security policies set forth in the Contract as the same may be supplemented or amended by the State and provided to Contractor from time to time.

Contractor Systems. Contractor will be solely responsible for the information technology infrastructure, including all computers, software, databases, electronic systems (including database management systems) and networks used by or for Contractor in connection with the Services (“Contractor Systems”) and shall prevent unauthorized access to State systems through the Contractor Systems.

Security Audits. During the Term, Contractor will:

maintain complete and accurate records relating to its data protection practices, IT security controls, and the security logs of any of the State’s Confidential Information, including any backup, disaster recovery or other policies, practices or procedures relating to the State’s Confidential Information and any other information relevant to its compliance with this Schedule;

upon the State’s request, make all such records, appropriate personnel and relevant materials available during normal business hours for inspection and audit by the State or an independent data security expert that is reasonably acceptable to Contractor, provided that the State: (i) gives Contractor at least five (5) Business Days prior notice of any such audit; (ii) undertakes such audit no more than once per calendar year, except for good cause shown; and (iii) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations and that complies with the terms and conditions of all data confidentiality, ownership, privacy, security and restricted use provisions of the Contract. The State may, but is not obligated to, perform such security audits, which shall, at the State’s option and request, include penetration and security tests, of any and all Contractor Systems and their housing facilities and operating environments; and

0. if requested by the State, provide a copy of Contractor’s FedRAMP System Security Plan. The System Security Plan will be recognized as Contractor’s Confidential Information.

Nonexclusive Remedy for Security Breach. Any failure of the Services to meet the requirements of this Schedule with respect to the security of any State Data or other Confidential Information of the State, including any related backup, disaster recovery or other policies, practices or procedures, is a material breach of the Contract for which the State, at its option, may terminate the Contract immediately upon written notice to Contractor without any notice or cure period, and Contractor must promptly reimburse to the State any Fees prepaid by the State prorated to the date of such termination.