Veritas Cloud Hosted.docx

Include the following as part of the procurement request and contract for systems hosted in a vendor cloud environment.

Security Requirements:

· Vendor will notify the State’s Chief Information Security Officer within 24 hours of any information breach or other security incident which impacts the State’s data.

· Vendor shall have a documented security incident policy and plan. Vendor must supply a copy at the request of the State of Illinois.

· Vendor must comply with all Federal and State laws, rules and regulations.

(See Appendix S1)

· Vendor must comply with all State of Illinois Enterprise Security Policies (https://www2.illinois.gov/sites/doit/support/policies/Pages/default.aspx).

· Vendor’s system must meet State of Illinois accessibility requirement as defined in the Illinois Information Technology Accessibility Act. If available, Vendor must provide the State of Illinois their most recent Voluntary Product Accessibility Template (VPAT).

· Vendor program and project management personnel must ensure coordination of activities with State of Illinois Governance program. Vendor must comply will all policies, standards and procedures defined by the State of Illinois’ Department of Innovation and Technology’s Enterprise Portfolio Management Office.

· Vendor’s system must have the ability to interface with the State’s Identity and Access Management solutions if credentialing is required.

· Vendor’s system must have the ability to log activity within the system and have the ability to forward log information to the State’s security incident and event management system (SIEM). Vendor must meet the State of Illinois’ Minimum Logging Requirements.

(See Security Appendix S2)

· Vendor certifies it has undertaken independent third-party audit Statement on Standards for Attestation Engagements (SSAE-18) certifications and must provide the State with System Operation Controls report (SOC 2) annually and applicable or Bridge/Gap letter.

· Vendor certifies it has undertaken independent third-party audit Statement on Standards for Attestation Engagements (SSAE-18) certifications and must provide the State with System Operation Controls report (SOC 1) annually and applicable or Bridge/Gap letter when vendor is hosting the State of Illinois financial information.

· Vendor must participate in an annual risk assessment and data classification and system categorization process. The formal risk assessment will be administered by the State of Illinois.

· If the vendor cannot provide a SOC report and Bridge/Gap letter, or 3rd party risk assessment the Vendor must perform an internal security controls assessment to demonstrate compliance with the State of Illinois Vendor Security Controls, based on the current revision of NIST 800-53 security controls for a moderate system. The vendor must provide attestation of compliance along with the results of this assessment documented in a Security Assessment Report (SAR) to the State of Illinois.

(See Security Appendix S3)

· Vendor must provide a Plan of Action and Milestones (POA&M) to the State of Illinois that addresses any control deficiencies identified during the State of Illinois’ risk assessment, review of the Vendor’s SOC report/s, 3rd party assessment, internal security controls assessment. The POA&M should describe the deficiencies in the security controls, address the residual risk and detail plans for remediation. Vendor must provide the State of Illinois monthly updates regarding progress toward remediation of identified deficiencies.

(see Security Appendix S4)

· Vendor must complete and provide the State of Illinois an Authority to Operate (ATO) or Authority Connect (ATC) packet at the State of Illinois request. This packet must be renewed annually.

(See Security Appendix S5)

· Vendor must ensure all hosted data pertinent to this contract remains located within the contiguous United States.

· Vendor must ensure encryption of State of Illinois data at rest and in motion. This encryption must comply with encryption security controls as defined in the most current version of FIPS 140 using AES encryption with a minimum key length of 256 bits. Vendor must provide proof of encryption. Vendor must provide the State with the capabilities to manage encryption keys.

· Vendor must be store data in a non-proprietary format or vendor must provide a solution to extract any State of Illinois data stored in the vendor’s solution.

· Vendor must only use State or Participant data, or State-related or Participant-related data for the purposes stated in this contract.

· Vendor must maintain a robust and reliable data backup system. Vendor must supply a description of backup methodology and this methodology must meet defined MTD and RPO requirements.

· Vendor must provide a disaster recovery mythology and provide proof of annual disaster recovery testing, including issues discovered and remediation plans for the issues discovered.

· Vendor must ensure that production data is not used outside of the production environment.

· Vendor must provide a copy of all data to the State without delay upon request by the State.

· Vendor must provide a copy of all data to the State prior to termination of contract.

· Vendor must sanitize all media that contained State of Illinois data. Vendor must use the current revision of NIST Special Publication 800-88;Guidelines for Media Sanitization. Vendor must provide certification of media sanitization including the method, date and time.

· Vendor must use a form of “crypto shredding” acceptable to the State of Illinois for rendering all State of Illinois data hosted by the vendor inaccessible after a copy of all data has been provided to the State.

· Vendor and/or its agents must not resell nor otherwise redistribute information gained from its access to the State or Participants.

· Vendor must not engage in nor permit its agents to push adware, software, or marketing not explicitly authorized by the State.

· Vendor must allow the State of Illinois to perform vulnerability assessments.

(see Security Appendix S6)

· Vendor must remediate critical, high and medium vulnerabilities within the application that are detected during the security assessments and are determined by the State of Illinois to pose an unacceptable risk.

· Vendor must secure independent 3rd party penetration testing at regular intervals according to Cloud Security Alliance (CSA) and Open Web Application Security Project (OWASP) recommendations. Vendor must supply the results of the testing to the State of Illinois upon request.

Security Appendix S1 – Federal and State laws, rules and regulations

· Illinois Identity Protection Act (5 ILCS 179)

· Illinois Personal Information Protection Act (815 ILCS 530)

· Illinois Freedom of Information Act (5 ILCS 140)

· Tax Information Security Guidelines (Pub. 1075)

· Health Information Technology (HITech)

Security Appendix S2 – Minimum Logging Requirements

· Input validation failures e.g. protocol violations, unacceptable encodings, invalid parameter names and values

· Output validation failures e.g. database record set mismatch, invalid data encoding

· Authentication successes and failures

· Authorization (access control) failures

· Session management failures e.g. cookie session identification value modification

· Application errors and system events e.g. syntax and runtime errors, connectivity problems, performance issues, third party service error messages, file system errors, file upload virus detection, configuration changes

· Application and related systems start-ups and shutdowns, and logging initialization (starting, stopping or pausing)

· Use of higher-risk functionality e.g. network connections, addition or deletion of users, changes to privileges, assigning users to tokens, adding or deleting tokens, use of systems administrative privileges, access by application administrators, all actions by users with administrative privileges, access to payment cardholder data, use of data encrypting keys, key changes, creation and deletion of system-level objects, data import and export including screen-based reports, submission of user-generated content - especially file uploads

· Legal and other opt-ins e.g. permissions for mobile phone capabilities, terms of use, terms & conditions, personal data usage consent, permission to receive marketing communications

Security Appendix S3: Security Controls for Vendors Authoritative Document NIST 800-53 v4 – Security and Privacy Controls Access and Control (AC) Organizations must limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems) and to the types of transactions and functions that authorized users are permitted to exercise.

AC Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Awareness and Training (AT) Organizations must (i) ensure that managers and users of organizational information systems are made aware of the security risks associated with their activities and of the applicable laws, Executive Orders, directives, policies, standards, instructions, regulations, or procedures related to the security of organizational information systems; and (ii) ensure that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.

AT - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Audit and Accountability (AU) Organizations must: (i) create, protect, and retain information system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity; and (ii) ensure that the actions of individual information system users can be uniquely traced to those users, so they can be held accountable for their actions.

AU - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Certification, Accreditation, and Security Assessments (CA) Organizations must: (i) periodically assess the security controls in organizational information systems to determine if the controls are effective in their application; (ii) develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organization information systems; (iii) authorize the operation of organizational information systems and any associated information system connections; and (iv) monitor information system security controls on an ongoing basis to ensure the continued effectiveness of the controls.

CA - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Configuration Management (CM) Organizations must: (i) establish and maintain baseline configurations and inventories of organizational information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles; and (ii) establish and enforce security configuration settings for information technology products employed in organizational information systems.

CM - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Contingency Planning (CP) Organizations must establish, maintain, and effectively implement plans for emergency response, backup operations, and post-disaster recovery for organizational information systems to ensure the availability of critical information resources and continuity of operations in emergency situations.

CP - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Identification and Authentication (IA) Organizations must identify information system users, processes acting on behalf of users, or devices and authenticate (or verify) the identities of those users, processes, or devices as a prerequisite to allowing access to organizational information systems.

IA - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Incident Response (IR) Organizations must: (i) establish an operational incident handling capability for organizational information systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities; and (ii) track, document, and report incidents to appropriate organizational officials and or authorities.

IR - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Maintenance (MA) Organizations must: (i) perform periodic and timely maintenance on organizational information systems; and (ii) provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct information system maintenance.

MA - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Media Protection (MP) Organizations must: (i) protect information system media, both paper and digital; (ii) limit access to information on information system media to authorized users; and (iii) sanitize or destroy information system media before disposal or release for reuse.

MP - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Physical and Environmental Protection (PE) Organizations must: (i) limit physical access to information systems, equipment, and the respective operating environments to authorized individuals; (ii) protect the physical plant and support infrastructure for information systems; (iii) provide supporting utilities for information systems; (iv) protect information systems against environmental hazards; and (v) provide appropriate environmental controls in facilities containing information systems.

PE - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Planning (PL) Organizations must develop, document, periodically update, and implement security plans for organizational information systems that describe the security controls in place or planned for the information systems and the rules of behavior for individual’s accessing the information systems.

PL - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Personnel Security (PS) Organizations must: (i) ensure that individuals occupying positions of responsibility within organizations (including third-party service providers) are trustworthy and meet established security criteria for those positions; (ii) ensure that organizational information and information system are protected during and after personnel actions such as terminations and transfers; and (iii) employ formal sanctions for personnel failing to comply with organizational security policies and procedures.

PS - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Risk Assessment (RA) Organizations must periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets and individuals, resulting from the operation of organizational information systems and the associated processing, storage, or transmission of organizational information.

RA - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

System and Services Acquisition (SA) Organizations must: (i) allocate sufficient resources to adequately protect organizations information system; (ii) employ system development life cycle processes that incorporate information security considerations; (iii) employ software usage and installation restrictions; and (iv) ensure that third-party providers employ adequate security measures to protect information, applications, and or services outsourced from the organization.

SA - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

System and Communications Protection (SC) Organizations must: (i) monitor, control, and protect organizational communications (i.e. information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries for the information systems; and (ii) employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organization information systems.

SC - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

System and Information Integrity (SI) Organizations must: (i) identify, report, and correct information and information systems flaws in a timely manner; (ii) provide protection from malicious code at appropriate locations within organizational information systems, and (iii) monitor information system security alerts and advisories and take appropriate actions in response.

SI - NIST Security Controls and Control Enhancements (for Moderate Security Categorization):

Authority

Security Appendix S4 - Plan of Actions and Milestones Template

Security Appendix 5 – Authority to Operate / Authority to Connect Packet

Security Appendix S5 – Authority Packet STATE OF ILLINOIS NIST and FISMA Compliance Document Project Name:

Date:

Duration of Project:

Vendor/Business Associate Name:

Vendor/Business Associate Contact Information:

A. The departments and agencies within all branches of the Federal Government are required by Federal Information Security Modernization Act (FISMA) of 2014 to comply with OMB E-GOV guidance to provide information security for the information and information systems that support the operations and assets under their control. The Federal Office of Management and Budget (OMB) has published guidance for the executive branch in OMB Circulars A-123, Appendix D and A-130.

B. STATE OF ILLINOIS recognizes that FISMA compliance, effective information security management and continuous monitoring of information systems are paramount to the success of HFS IT systems. In order to establish an information security program in accordance with the FISMA, the Vendor must follow the National Institute for Standards and Technology (NIST) Guidelines of the NIST Risk Management Framework (RMF), as amended.

C. Requirements

(1) Each requirement in the table below is understood to contain the implied prefix, "The Vendor/Business Associate shall..."

VENDOR RESPONSE:

VENDOR RESPONSE:

VENDOR RESPONSE:

VENDOR RESPONSE:

VENDOR RESPONSE:

VENDOR RESPONSE:

This SSP must be approved by authorizing official within STATE OF ILLINOIS. The SSP must include but not limited to the following:

i. Description of how the system is to be compliant with all the Federal and State laws regarding the security and privacy of medical data and records, and of all protected health information (PHI), including:

a) The Code of Federal Regulations (at 45 CFR 95.621) which provides that State agencies are responsible for the security of all automated data processing systems involved in the administration of Department of Health and Human Services’ programs, and which includes the establishment of a security plan that outlines how software and data security will be maintained. This section further requires that State agencies conduct a review and evaluation of physical and data security operating procedures and personnel practices on a biennial basis.

b) The security and privacy standards contained in Pub. L. 104–191, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and adopted in 45 CFR Part 164, Subparts C and E, as follows: The security standards require that measures be taken to secure protected heath information that is transmitted or stored in electronic format. The privacy standards apply to protected health information that may be in electronic, oral, and paper form.

c) The requirements in section 1902(a)(7) of the Social Security Act (the Act), as further interpreted in Federal regulations at 42 CFR 431.300 to 307.

d) Description of the process Vendor will use to report security breach incidents (regardless of severity or loss of actual data) to STATE OF ILLINOIS within 4 hours.

ii. Description of measures to secure data and software;

iii. Description of how data is encrypted in transit and in storage;

iv. Description of physical and equipment security measures;

v. Description of personnel security;

vi. Description of software used for security;

vii. Description of the user roles and the access capabilities of each role;

viii. Description of how users are assigned certain roles;

ix. Identification of the staff responsible for controlling the system security;

x. Description of contingency security procedures during a disaster recovery event;

xi. Description of how the Vendor works with STATE OF ILLINOIS to conduct annual security review;

xii. Password security

xiii. Audit trails for all data access;

xiv. Vendor will be responsible for all costs associated with Identify theft, resulting from security breach.

D. Security Risk Assessment. STATE OF ILLINOIS or an independent entity will perform a security control assessment. STATE OF ILLINOIS will provide the vendor a copy of the approved security control assessment. Once the Vendor receives the approved assessment, the Vendor must then develop a Security Risk Assessment based on the applicable security controls. Guidance to conducting and documenting the Security Risk Assessment can be obtained in NIST SP 800-30.

E. Plan of Action and Milestones (POA&M). After STATE OF ILLINOIS reviews and approves the Security Risk Assessment, the Vendor should begin to develop a POA&M. The POA&M should be a living document that is based on the findings and recommendations of the security assessment report. The POA&M should describe the deficiencies in the security controls,address the residual risk and detail plans for remediation.

F. Authorization approval package.

(a) After STATE OF ILLINOIS reviews and approves the POA&M, the Vendor must prepare a transmittal letter to request approval of the entire authorization package. The authorization package must include at a minimum the following documents.

i. Transmittal Letter

ii. Updated System Security Plan

iii. Security Assessment Plan (include the STATE OF ILLINOIS/independent security assessment)

iv. Security Assessment Report (include the STATE OF ILLINOIS/independent security assessment)

v. Security Risk Assessment

vi. Plan of Action and Milestones

vii. Supporting Documentation including but not limited to design documentation, “As Built” documentation, operational documentation, validation documentation, prior authorization documentation, and other artifacts associated with the implementation and monitoring of the security controls.

(b) The authorizing official will determine the risk to the organizational operation and determine if the system is authorized to proceed. The authorizing official will deliver to the Vendor a letter of authorization specifying any limitations or restriction placed on the operation of the system. Additionally, this letter should establish end date for the security authorization.

(c) If the authorizing official denies the authorization, STATE OF ILLINOIS will continue to work with the Vendor until an acceptable level of residual risk for the system is achieved. This work would include the continued remediation listed in the POA&M.

(a) Performing continuous monitoring of the security system. Vendor’s continuous monitoring must include periodically selecting a subset of the baseline controls for assessment. Based on assessment of these controls, subsequent remediation actions must be identified and implemented. The ongoing remediation process should include updating key documents such as the SSP, SAR, and POA&M.

(b) Prior to any system or environmental modifications, the Vendor must perform a security impact analysis. This must be included as a part of any change management or configuration management process. If the results of the modification indicate changes to security posture of the system, corrective actions should be initiated and appropriate documents revised and updated. The updating of the documentation and continuous monitoring should provide near real-time risk management.

(c) A monthly Security Status Report must be produced by the Vendor for STATE OF ILLINOIS. The Status Report should provide essential information regarding the security posture of the system as well as the effectiveness of the controls deployed. Ongoing monitoring activities should be detailed as well as ongoing remediation efforts to address know vulnerabilities. Additional guidance for the monitoring of system security can be obtained in NIST SP 800-137.

Security Appendix S6 – Vulnerability Assessment

· Vendor must obtain cloud hosting vendor’s approval on behalf of the State of Illinois to perform vulnerability assessments on the cloud hosted website/s.

· Vendor must execute the State of Illinois Vulnerability Scanning Agreement prior to vulnerability assessment.

(See DoIT Scanning Agreement)

· State of Illinois may with reasonable notice to Vendor, conduct a security assessment of Vendor’s solution which may include the following;

· Prior to initial “Official” production role out of the application,

· Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application.

· Manual verification of scan results with the same credentials

· Manual testing of the application for vulnerabilities

· State of Illinois will not conduct any Denial of Service (DOS) attacks

· State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)

· On a quarterly basis for the for the first year after initial production deployment;

· Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application.

· Manual verification of scan results with the same credentials

· Manual testing of the application for vulnerabilities

· State of Illinois will not conduct any DOS attacks

· State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)

· Prior to any enhancements or upgrades being deployed to production after the initial “official” production role out of the application,

· Whitelisted scanning and manual testing of the application only, with application credentials equal to the least privileged role within the application.

· Manual verification of scan results with the same credentials

· Manual testing of the application for vulnerabilities

· State of Illinois will not conduct any DOS attacks

· State of Illinois will not scan or test any infrastructure devices (servers, switches, routers, intrusion protection system, firewalls, etc.)

· Monthly vulnerability scan – no whitelisting, non-credentialed scan (same day every month).

DoIT Scanning Agreement DDDDddd image1.jpg