Schedule E Data Security Requirements REVISED2.docx

STATE OF MICHIGAN

Request For Proposal No.200000001290

SCHEDULE E

DATA SECURITY REQUIREMENTS

1. Definitions. For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Section 1 shall have the respective meanings given to them in the Contract.

“Contractor Security Officer” has the meaning set forth in Section 2 of this Schedule.

“Contractor Systems” has the meaning set forth in Section 5 of this Schedule.

“FedRAMP” means the Federal Risk and Authorization Management Program, which is a federally approved risk management program that provides a standardized approach for assessing and monitoring the security of cloud products and services.

“FISMA” means the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.).

“Hosted Services” means the hosting, management and operation of the computing hardware, ancillary equipment, Software, firmware, data, other services (including support services), and related resources for remote electronic access and use by the State and its Authorized Users, including any services and facilities related to disaster recovery obligations.

“NIST” means the National Institute of Standards and Technology.

“PSP” means the State’s IT Policies, Standards and Procedures

“PCI” means the Payment Card Industry.

“SSAE” means Statement on Standards for Attestation Engagements.

2. Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Contractor Systems who has sufficient knowledge of the security of the Contractor Systems and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”). The Contractor Security Officer will be considered Key Personnel under the Contract.

3. Protection of the State’s Confidential Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

3.1. for any cloud based solutions the Software and State data must be hosted in a government cloud solution, and Contractor must maintain an annual SSAE 16 SOC 2 Type 2 audit for the Hosted Services throughout the Term maintain FedRAMP certification for the Hosted Services throughout the Term, and in the event the contractor is unable to maintain FedRAMP certification, the State may move the Software to an alternative provider, at contractor’s sole cost and expense;

3.2. ensure that the Software and State Data is securely hosted, supported, administered, and accessed in a data center and backup data center that resides in the continental United States, and minimally meets Uptime Institute Tier 3 standards (www.uptimeinstitute.com), or its equivalent;

3.3. maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State’s Confidential Information that comply with the requirements of the State’s data security policies as set forth in the Contract, and must, at a minimum, remain compliant with FISMA and the NIST Special Publication 800.53 (most recent version) MOD Controls using minimum control values as established in the applicable PSP;

3.4. provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the processing of the State’s Confidential Information and the nature of such Confidential Information, consistent with best industry practice and standards;

(b) prevent (i) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Services; (ii) the State’s Confidential Information from being commingled with or contaminated by the data of other customers or their users of the Services; and (iii) unauthorized access to any of the State’s Confidential Information;

3.6. ensure that State Data is encrypted in transit and at rest using AES 256bit or higher encryption;

3.7. ensure that State Data is encrypted in transit and at rest using currently certified encryption modules in accordance with FIPS PUB 140-2 (as amended). Security Requirements for Cryptographic Modules;

3.8. ensure the Hosted Services support Identity Federation/Single Sign-on (SSO) capabilities using Security Assertion Markup Language (SAML) or comparable mechanisms;

3.9. ensure the Hosted Services have multi-factor authentication for privileged/administrative access; and

3.10. assist the State, at no additional cost, with development and completion of a system security plan using the State's automated governance, risk and compliance (GRC) platform. See also Section 9 ATO Security Process.

4. Unauthorized Access. Contractor may not access, and shall not permit any access to, State systems, in whole or in part, whether through Contractor’s Systems or otherwise, without the State’s express prior written authorization. Such authorization may be revoked by the State in writing at any time in its sole discretion. Any access to State systems must be solely in accordance with the Contract and this Schedule, and in no case exceed the scope of the State’s authorization pursuant to this Section 5. All State-authorized connectivity or attempted connectivity to State systems shall be only through the State’s security gateways and firewalls and in compliance with the State’s security policies set forth in the Contract as the same may be supplemented or amended by the State and provided to Contractor from time to time.

5. Contractor Systems. Contractor will be solely responsible for the information technology infrastructure, including all computers, software, databases, electronic systems (including database management systems) and networks used by or for Contractor in connection with the Services (“Contractor Systems”) and shall prevent unauthorized access to State systems through the Contractor Systems.

6. Security Audits. During the Term, Contractor will:

6.1. maintain complete and accurate records relating to its data protection practices, IT security controls, and the security logs of any of the State’s Confidential Information, including any backup, disaster recovery or other policies, practices or procedures relating to the State’s Confidential Information and any other information relevant to its compliance with this Schedule;

6.2. upon the State’s request, make all such records, appropriate personnel and relevant materials available during normal business hours for inspection and audit by the State or an independent data security expert that is reasonably acceptable to Contractor, provided that the State: (i) gives Contractor at least five (5) Business Days prior notice of any such audit; (ii) undertakes such audit no more than once per calendar year, except for good cause shown; and (iii) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations and that complies with the terms and conditions of all data confidentiality, ownership, privacy, security and restricted use provisions of the Contract. The State may, but is not obligated to, perform such security audits, which shall, at the State’s option and request, include penetration and security tests, of any and all Contractor Systems and their housing facilities and operating environments; and

6.3. if requested by the State, provide a copy of Contractor’s SSAE 16 SOC 2 Type 2 audit report to the State within thirty (30) days of the Contract’s Effective Date. Any such audit reports will be recognized as Contractor’s Confidential Information.

6.4. if requested by the State, provide a copy of Contractor’s FedRAMP System Security Plan. The System Security Plan will be recognized as Contractor’s Confidential Information.

7. Nonexclusive Remedy for Security Breach. Any failure of the Services to meet the requirements of this Schedule with respect to the security of any State Data or other Confidential Information of the State, including any related backup, disaster recovery or other policies, practices or procedures, is a material breach of the Contract for which the State, at its option, may terminate the Contract immediately upon written notice to Contractor without any notice or cure period, and Contractor must promptly reimburse to the State any Fees prepaid by the State prorated to the date of such termination.

8. PCI Compliance.

8.1. Contractors that process, transmit, store or affect the security of credit/debit cardholder data, must adhere to the PCI Data Security Standards (the most recent version). The Contractor is responsible for the security of cardholder data in its possession. The data may only be used to assist the State or for other uses specifically authorized by law.

8.2. The Contractor must notify the State’s Contract Administrator (within 48 hours of discovery) of any breaches in security where cardholder data has been compromised. In that event, the Contractor must provide full cooperation to the card associations (e.g. Visa, MasterCard, and Discover) and state acquirer representative(s), or a PCI approved third party, to conduct a thorough security review. The Contractor must provide, at the request of the State, the results of such third party security review. The review must validate compliance with the PCI Data Security Standard for protecting cardholder data. At the State’s sole discretion, the State may perform its own security review, either by itself or through a PCI approved third party.

8.3. The Contractor is responsible for all costs incurred as the result of the breach. Costs may include, but are not limited to, fines/fees for non-compliance, card reissuance, credit monitoring, and any costs associated with a card association, PCI approved third party, or State initiated security review.

8.4. Without limiting Contractor’s obligations of indemnification as further described in this Contract, Contractor must indemnify, defend, and hold harmless the State for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the State in connection with the breach.

8.5. The Contractor must dispose of cardholder data when it is no longer needed in compliance with PCI DSS policy. The Contractor must continue to treat cardholder data as confidential upon contract termination.

8.6. The Contractor must provide the State’s Contract Administrator with an annual Attestation of Compliance (AOC) or a Report on Compliance (ROC) showing the contractor is in compliance with the PCI Data Security Standard. The Contractor must notify the State’s Contract Administrator of all failures to comply with the PCI Data Security Standard.

9. Authority to Operate (ATO) Security Process Contractor is required to assist with the SOM Security Accreditation process and provide required information and documentation., In addition, Contractor’s solution must meet the State’s Secure Application Development Standards as mandated by the State of Michigan (SOM) which includes:

9.1. Application Scanning

Externally hosted solutions Contractor is required to grant the right to the SOM to scan either the application code or a deployed version of the solution deployed to the SOM; or in lieu of the SOM performing a scan, Contractor will provide the SOM a vulnerabilities assessment after Contractor has used IBM AppScan or a SOM approved application scanning tool. Software must be scanned prior to every major release (significant change) or every 3 years, whichever is sooner. This aligns with the SOM’s Authority To Operate (ATO) process. The process for determining if a change is “significant” is defined in the SOM Governance, Risk and Compliance (GRC) tool referred to as “Keylight”.

For Commercial Off-The-Shelf (COTS) or vendor owned applications, Contractor, at its sole expense, must provide resources to complete the scanning and to complete the analysis, remediation and validation of vulnerabilities identified by the scan as required by the State Secure Web Application Standards. Contractor will provide the SOM with a comprehensive list of all vulnerabilities each time application scanning is performed. Test policies for each scan performed shall be made available to the SOM upon request to ensure that what they are testing for is adequate.

SOM requires vendors/ contractors to perform both these scans and provide detailed report on vulnerabilities. SOM requires the test policy/ plan followed by vendor/ contractor that resulted in the scan that produced the report.

9.2. Infrastructure Scanning

Externally hosted solutions: A Contractor providing Hosted Services must scan the infrastructure at least once every 30 days and provide the scan’s assessment to the State in a format that can be uploaded by the State and used to track the remediation. Contractor will provide the SOM with a comprehensive list of all vulnerabilities each time infrastructure scanning is performed. Test policies for each scan performed shall be made available to the SOM upon request to ensure that what they are testing for is adequate.