Security Requirements The Contractor Ensure that its personnel is familiar with, and exercises due diligence in carrying out, the State’s IT Security Policy (see Section 3.5.E.1.b.1). Comply with the Federal Guidelines for Web Accessibility, available at . Not place confidential or sensitive data on any application servers, database servers, or infrastructure components that require direct access from the Internet. Establish appropriate procedures to protect documents, computer information/data, and system documentation from unauthorized disclosure, modification, removal, and destruction, including suitable measures to properly dispose of media when it is no longer needed. Implement cryptographic solutions (encryption) when the confidentiality or sensitivity of information shall be maintained while a message is in transit between computing devices and when confidential or sensitive information is stored in a file or database. Develop a documented process to ensure that access privileges are verified at least once in six (6) months. Develop an automated process to ensure that user sessions time out a period of fifteen (15) minutes of inactivity. Develop a documented process to ensure that access rights reflect changes in employee/Contractor status within twenty-four (24) of the change. Develop a documented process to ensure that physical and logical access is immediately disabled upon a change in employment status where appropriate. Develop an automated or documented process to ensure that user IDs are disabled after sixty (60) calendar days of inactivity unless they are extended through the explicit approval of the State Project Manager. System IDs are excluded but should be changed at an interval of not less than one (1) year.
Security Requirements The Contractor Ensure that its personnel is familiar with, and exercises due diligence in carrying out, the State’s IT Security Policy (see Section 3.5.E.1.b.1). Comply with the Federal Guidelines for Web Accessibility, available at . Not place confidential or sensitive data on any application servers, database servers, or infrastructure components that require direct access from the Internet. Establish appropriate procedures to protect documents, computer information/data, and system documentation from unauthorized disclosure, modification, removal, and destruction, including suitable measures to properly dispose of media when it is no longer needed. Implement cryptographic solutions (encryption) when the confidentiality or sensitivity of information shall be maintained while a message is in transit between computing devices and when confidential or sensitive information is stored in a file or database. Develop a documented process to ensure that access privileges are verified at least once in six (6) months. Develop an automated process to ensure that user sessions time out a period of fifteen (15) minutes of inactivity. Develop a documented process to ensure that access rights reflect changes in employee/Contractor status within twenty-four (24) of the change. Develop a documented process to ensure that physical and logical access is immediately disabled upon a change in employment status where appropriate. Develop an automated or documented process to ensure that user IDs are disabled after sixty (60) calendar days of inactivity unless they are extended through the explicit approval of the State Project Manager. System IDs are excluded but should be changed at an interval of not less than one (1) year.
1.%20RFP%20FINAL%20for%20RMTS%20Software-Revised%203.26.14.docx