The Contractor will: Perform configuration review of operating system, application and database settings Ensure software development personnel receive training in writing secure code System Administrator Access The Contractor will Inventory all administrative passwords (application, database and operating system Implement policies to change default passwords in accordance with State policies, particular following any transfer or termination of personnel (State, existing MSV or Contractor) Configure administrative accounts to require regular password changes Ensure service accounts have cryptographically strong passwords Store passwords in a hashed or encrypted format Ensure administrative accounts are used only for administrative activities Implement focused auditing of administrative privileged functions Configure systems to log entry and alert when administrative accounts are modified Segregate administrator accounts based on defined roles Account Access Privileges The Contractor will: Review and disable accounts not associated with a business process Create daily report that includes locked out accounts, disabled accounts, etc. Implement process for revoking system access Automatically log off after a standard period of inactivity Monitor account usage to determine dormant accounts Monitor access attempts to deactivated accounts through audit logging Profile typical account and implement or maintain profiles to ensure that Security profiles are implemented correctly and consistently Additional Controls and Responsibilities The Contractor will meet with the State no less frequently than annually to: Review, Update and Conduct Security training for personnel, based on roles Review the adequacy of physical and environmental controls Verify the encryption of sensitive data in transit Review access control to information based on established roles and access profiles Update and review system administration documentation Update and review system maintenance policies Update and Review system and integrity policies Revised and Implement updates to the System security program plan Update and Implement Risk Assessment Policies and procedures Update and implement incident response procedures
The Contractor will: Perform configuration review of operating system, application and database settings Ensure software development personnel receive training in writing secure code System Administrator Access The Contractor will Inventory all administrative passwords (application, database and operating system Implement policies to change default passwords in accordance with State policies, particular following any transfer or termination of personnel (State, existing MSV or Contractor) Configure administrative accounts to require regular password changes Ensure service accounts have cryptographically strong passwords Store passwords in a hashed or encrypted format Ensure administrative accounts are used only for administrative activities Implement focused auditing of administrative privileged functions Configure systems to log entry and alert when administrative accounts are modified Segregate administrator accounts based on defined roles Account Access Privileges The Contractor will: Review and disable accounts not associated with a business process Create daily report that includes locked out accounts, disabled accounts, etc. Implement process for revoking system access Automatically log off after a standard period of inactivity Monitor account usage to determine dormant accounts Monitor access attempts to deactivated accounts through audit logging Profile typical account and implement or maintain profiles to ensure that Security profiles are implemented correctly and consistently Additional Controls and Responsibilities The Contractor will meet with the State no less frequently than annually to: Review, Update and Conduct Security training for personnel, based on roles Review the adequacy of physical and environmental controls Verify the encryption of sensitive data in transit Review access control to information based on established roles and access profiles Update and review system administration documentation Update and review system maintenance policies Update and Review system and integrity policies Revised and Implement updates to the System security program plan Update and Implement Risk Assessment Policies and procedures Update and implement incident response procedures
DBLOT-18-03-001_DBLOT-18-03-001%20MW%20Word%20version.docx