requirements, including those relating to the prevention and detection of fraud and any other inappropriate use or access of systems and networks. All data in transit and at rest must be encrypted. All data in transit and rest must remain in the continental United States. The network traffic to and from the proposed hosted solution must be encrypted using SSL or stronger. The proposed system must not use proprietary encryption techniques. The system must use AES 256 or higher encryption. The standard for exchange of data within the system must be a secure hypertext transport protocol or https. For any breach or suspected breach of security of the collected data, the Vendor shall: Notify the MDES designated contact within one (1) hour by telephone or e-mail of the breach/suspected breach; Conduct an investigation of the identified breach/suspected breach(describe the process followed); Confiscate, document and secure any evidence supporting the identified problem; Provide MDES with a written report of the investigation within three (3) business days of identification of the breach/suspected breach; Provide a detailed written report within seven (7) business days outlining the impact of the breach and the steps taken to correct the situation, prevent future breaches, and the time frame for resolution. Assist MDES, including testifying, in any proceedings or hearings, which occur as the result of the breach/suspected breach. Data Storage
requirements, including those relating to the prevention and detection of fraud and any other inappropriate use or access of systems and networks. All data in transit and at rest must be encrypted. All data in transit and rest must remain in the continental United States. The network traffic to and from the proposed hosted solution must be encrypted using SSL or stronger. The proposed system must not use proprietary encryption techniques. The system must use AES 256 or higher encryption. The standard for exchange of data within the system must be a secure hypertext transport protocol or https. For any breach or suspected breach of security of the collected data, the Vendor shall: Notify the MDES designated contact within one (1) hour by telephone or e-mail of the breach/suspected breach; Conduct an investigation of the identified breach/suspected breach(describe the process followed); Confiscate, document and secure any evidence supporting the identified problem; Provide MDES with a written report of the investigation within three (3) business days of identification of the breach/suspected breach; Provide a detailed written report within seven (7) business days outlining the impact of the breach and the steps taken to correct the situation, prevent future breaches, and the time frame for resolution. Assist MDES, including testifying, in any proceedings or hearings, which occur as the result of the breach/suspected breach. Data Storage
43163-B%20LOC.docx