Security Data Services

The Vendor is required to provide for security data services.
- The Contractor’s Information Security Program shall:
•    Protect the confidentiality, integrity, and availability of county information in the contractor’s possession or control;
•    Protect against any anticipated threats or hazards to the confidentiality, integrity, and availability of county information;
•    Protect against unauthorized or unlawful access, use, disclosure, alteration, or destruction of county information;
•    Protect against accidental loss or destruction of, or damage to, county information; and
•    County information in compliance with any applicable laws and regulations which apply to the contractor.
- Privacy Program shall include:
•    A privacy program framework that identifies and ensures that the contractor complies with all applicable laws and regulations;
•    External privacy policies, and internal privacy policies, procedures and controls to support the privacy program;
•    Protections against unauthorized or unlawful access, use, disclosure, alteration, or destruction of county information;
•    A training program that covers privacy policies, protocols and awareness;
•    A response plan to address privacy incidents and privacy breaches; and
•    Ongoing privacy assessments and audits.
- Encrypt county information transmitted on networks outside of the contractor’s control with transport layer security (tls) or internet protocol security (IPsec), at a minimum cipher strength of 128 bit or an equivalent secure transmission protocol or method approved by county’s chief information security officer.
- All mobile devices storing county information shall be managed by a mobile device management system.
- Such system must provide provisions to enforce a password/passcode on enrolled mobile devices. 
- All workstations/personal computers (including laptops, 2-in-1s, and tablets) will maintain the latest operating system security patches, and the latest virus definitions. 
- Virus scans must be performed at least monthly.

- Contract Period/Term: 1 year