Schedule E Data Security Requirements.docx

Schedule E Data Security Requirements

Definitions. For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Section 1 shall have the respective meanings given to them in the Contract.

“Contractor Security Officer” has the meaning set forth in Section 2 of this Schedule.

“FISMA” means The Federal Information Security Management Act of 2002 (44 U.S.C. ch. 35, subch. III § 3541 et seq.)

“Hosted Services” means the hosting, management and operation of the computing hardware, ancillary equipment, Software, firmware, data, other services (including support services), and related resources for remote electronic access and use by the State and its Authorized Users

“NIST” means the National Institute of Standards and Technology.

“PSP” means the State’s IT Policies, Standards and Procedures located at: http://michigan.gov/dtmb/0,4568,7-150-56355_56579_56755---,00.html Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Contractor Systems who has sufficient knowledge of the security of the Contractor Systems and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”). The Contractor Security Officer will be considered Key Personnel under the Contract.

Protection of the State’s Confidential Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

ensure that the Software and data, including backup data, is securely hosted, supported, administered, and accessed in a data center that resides in the continental United States, and minimally meets Uptime Institute Tier 3 standards (www.uptimeinstitute.com), or its equivalent;

maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its hosting, transmitting, and Processing of the State’s Confidential Information that comply with the requirements of the State’s data security policies as set forth in the Contract, and must, at a minimum, remain compliant with FISMA and NIST Special Publication 800.53 (most recent version) LOW Controls using minimum control values as established in the applicable PSP;

provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the processing of the State’s Confidential Information and the nature of such Confidential Information, consistent with best industry practice and standards;

take all reasonable measures to:

secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Services against “hackers” and others who may seek, without authorization, to disrupt, damage, modify, access or otherwise use Contractor Systems or the information found therein; and prevent (i) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Services; (ii) the State’s Confidential Information from being commingled with or contaminated by the data of other customers or their users of the Services; and (iii) unauthorized access to any of the State’s Confidential Information;

State Data must be encrypted in transit and at rest using currently certified encryption modules in accordance with FIPS PUB 140-2 (as amended), Security Requirements for Cryptographic Modules;

the Hosted Services must have a secure method of authentication for access by Authorized Users.

the Hosted Services must have a secure multi-factor method of authentication for privileged/administrative access.

Unauthorized Access. Contractor may not access, and shall not permit any access to, State Systems, in whole or in part, whether through Contractor’s Systems or otherwise, without the State’s express prior written authorization. Such authorization may be revoked by the State in writing at any time in its sole discretion. Any access to State Systems must be solely in accordance with the Contract and this Schedule, and in no case exceed the scope of the State’s authorization pursuant to this Section 4. All attempted connectivity to State Systems shall be only through the State’s security gateways and firewalls and in compliance with the State’s security policies set forth in the Contract as the same may be supplemented or amended by the State and provided to Contractor from time to time.

Security Audits. During the Term, Contractor will:

maintain complete and accurate records relating to its data protection practices, IT security controls, breach notification response plan, and the security logs of any of the State’s Confidential Information, including any backup, disaster recovery or other policies, practices or procedures relating to the State’s Confidential Information and any other information relevant to its compliance with this Schedule;

upon the State’s request, make all such records, appropriate personnel and relevant materials available during normal business hours for inspection and audit by the State or an independent data security expert that is reasonably acceptable to Contractor, provided that the State: (i) gives Contractor at least five (5) Business Days prior notice of any such audit; (ii) undertakes such audit no more than once per calendar year, except for good cause shown; and (iii) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations and that complies with the terms and conditions of all data confidentiality, ownership, privacy, security and restricted use provisions of the Contract. The State may, but is not obligated to, perform such security audits, which shall, at the State’s option and request, include penetration and security tests, of any and all Contractor Systems and their housing facilities and operating environments; and Nonexclusive Remedy. Any failure of the Services to meet the requirements of this Schedule with respect to the security of any State Data or other Confidential Information of the State, including any related backup, disaster recovery or other policies, practices or procedures, is a material breach of the Contract for which the State, at its option, may terminate the Contract immediately upon written notice to Contractor without any notice or cure period, and Contractor must promptly reimburse to the State any Fees prepaid by the State prorated to the date of such termination.