Agenda packet — Finance Committee, April 29, 2024 (part 1 of 8)

- 1 -
4/29/2024 4:00:00 PM
www.modestogov.com
AGENDA
City of Modesto

FINANCE COMMITTEE

COUNCIL WORKSHOP
2001-40 Del Puerto Room
Tenth Street Place, 1010 10th Street
Modesto, California
Monday, April 29, 2024 at 4:00 PM
Roll Call: Nick Bavaro, Chair
Rosa Escutia-Braaton, Vice-Chair
David Wright, Member
Alternates: Eric Alvarez, Jeremiah Williams, Chris Ricci, Sue Zwahlen Council has not delegated directive or final approval authority to the Committees.

Committee actions are recommendations to the full City Council, not final decisions on an issue. * Public Comment will only be in-person. Members of the public who wish to address the Committee, by providing public comment, during the meeting must do so in-person in the 2001-40 Del Puerto Room. As an alternative, members of the public may also provide written public comment submitted via email as indicated in the Submitting Comments by Email instructions on this agenda. Zoom will still be available for viewing and Wordly translation. *Members of the public will be allowed to provide public comment through Zoom if a Committee Member is participating remotely pursuant to the provisions of Assembly Bill 2449. *Effective March 1, 2023, if a technical issue arises with Zoom or the phone dial-in option, the Committee meeting will continue unless the meeting is being held pursuant to the provisions of Assembly Bill 2449. Alternative viewing options are listed below, and the meeting is physically open to the public.
“Wordly” can translate into 25+ different languages! To access written translation during the meeting, please scan the QR Code or click this link https://attend.wordly.ai/join/RJDY-6364.
- 1 -
4/29/2024
- 2 -
4/29/2024 4:00:00 PM
"Wordly" puede traducir a más de 25 idiomas diferentes! Para acceder a la traducción durante la reunión, por favor escanee el código QR o haga clic en el enlace https://attend.wordly.ai/join/RJDY-6364.

You may observe a livestream of the meeting at http://media.modestogov.com. You may also view or listen to the meeting as indicated below.

THE MEETING CAN BE VIEWED BY ZOOM VIDEO

CONFERENCING OR TELEPHONE
Joining the Committee meeting via Zoom
The City of Modesto is now offering the ability to view Committee meetings via telephonic conferencing via “Zoom” video conferencing computer technology. The meeting may be accessed through the use of Zoom using the following options:
 Enter the following link into an Internet Browser
https://us02web.zoom.us/j/86945970570,
 Enter the following link into an Internet Browser https://zoom.us/ and using the Webinar ID 869 4597 0570
 Passcode 84326
To use Zoom, please visit: https://zoom.us/ and either sign-up for a free Zoom account or continue as a guest. Once you have downloaded the app onto your mobile device, joined from your web browser, or downloaded the Zoom software on your computer you will be ready for the upcoming Committee meeting.

Joining the Committee meeting via Telephone
If you don’t have a smart phone or computer to access the meeting via Zoom, you can listen by phone, by calling 1-877-853-5257 (Toll Free) or 1-888-475-4499 (Toll Free) and enter the Webinar ID 869 4597 0570 Passcode 84326

PUBLIC COMMENTS IN PERSON
Three-minute time limit per speaker.

Only interested persons in the audience may present these matters. Under State law, Committee Members may respond to matters being presented under this item only as follows:
a. Briefly respond to statements made or questions raised. b. Ask a question for clarification.
c. Provide a reference to staff or other resources for factual information. d. Request staff to report back at a subsequent meeting. e. Finally, a Committee Member or the Committee itself may take action to direct staff to place a matter of business on a future agenda.

SUBMITTING COMMENTS BY E-MAIL
Written comments may be submitted via email to: [email protected] (include Agenda Item Number in the subject line). All comments will be shared with the Committee - 2 -
4/29/2024
- 3 -
4/29/2024 4:00:00 PM
Members and placed in the record but will not be read aloud during the meeting. Written comments must be received two hours before the meeting.

This Agenda is on file in the City Clerk’s Office, Sixth Floor, 10th Street Place, Posting Board at entry of 10th Street Place, and is available on the City’s Web site at www.modestogov.com.

Materials related to an item on this Agenda submitted to the Council after distribution of the agenda packet are available for public inspection in the Clerk’s office during normal business hours. Such documents are also available online, subject to staff’s ability to post the documents before the meeting, at the following website www.modestogov.com/councilmeetings In accordance with the requirements of Title II of the Americans with Disabilities Act (“ADA”) of 1990, the Fair Employment & Housing Act (“FEHA”), the Rehabilitation Act of 1973 (as amended), Government Code section 11135 and other applicable codes, the City of Modesto (“City”) will not discriminate against individuals on the basis of disability in the City’s services, programs, or activities. For more information, please visit the City of Modesto website at https://www.modestogov.com/865/Americans-with-Disabilities-Act-ADA In compliance with the Americans with Disabilities Act, if you need special assistance to participate in this meeting, please contact the City Clerk (209) 577-5396. Notification 48 hours prior to the meeting will enable the City to make reasonable arrangements to ensure accessibility to this meeting
Any and all of the following agenda items are subject to action by the Modesto City Council.

CONSENT ITEMS – ROLL CALL VOTE REQUIRED:

Information concerning the consent items listed below has been forwarded to each Committee Member prior to this meeting for study. Unless some member of the audience or Committee Member has a question concerning an item and asks that it be withdrawn from the consent list, the Committee approves the items at one time. The action taken by the Committee in approving consent items is set forth in the explanation of this individual item.

CONSENT
An item may be removed from consent and discussed at the request of an audience member or Committee Member.

Consent

1. Consider the recommended budget adjustments to Fiscal Year 2023-24 Annual Operating and Capital Improvement Program Budgets; and forwarding to Council for approval. (Funding Source: Various Funds)
 Motion recommending the budget adjustments to Fiscal Year 2023-24 Annual Operating and Capital Improvement Program Budgets; and forwarding to Council for approval.

BUDGET; Steve Christensen, 209-577-5390, [email protected] - 3 -
4/29/2024
- 4 -
4/29/2024 4:00:00 PM
Consent

2. Consider the purchase of software programing and licensing with Carahsoft Technology Corp. of Reston, Virgina, for a total amount not to exceed $193,365 and forwarding to Council for approval. (Funding Source: Solid Waste Management Fund and SB 1383 Grant from CalRecycle)
 Motion recommending the Competitive Bidding Process from NASPO through the State of Utah with Carahsoft Technologies Corp., Reston Virginia for purchase of software programming and licensing, for a total amount not to exceed $193,365 and forwarding to Council for approval.

PUBLIC WORKS; Myriah Hill, 209-577-5495, [email protected] Consent

3. Consider the Second Amendment for the city-wide pest control services to a revised total amount of $393,410 and extend the term of the Agreement from April 30, 2024, to April 30, 2026, and forwarding to Council for approval. (Funding Source: Building Maintenance ISF)
 Motion recommending the Second Amendment to the Agreement with Clark Pest Control Inc., Modesto CA, for a city-wide pest control services to execute the year six extension option and increasing by $9,300 from $52,630 to a new estimated annual amount of $61,930 with a revised total amount not to exceed $393,410, extending the term of the Agreement from April 30, 2024, to April 30, 2026, and forwarding to Council for approval.

PUBLIC WORKS; Gabe da Silva, 209-652-2579, [email protected] Consent

4. Consider the submission of grant applications to the State Water Resources Control Board’s Safe and Affordable Drinking Water and Septic-to-Sewer Programs and forwarding to Council for approval. (Funding Source: Water & Sewer Fund)  Motion recommending the submission of a Septic-to-Sewer Program grant application to the State Water Resources Control Board to fund the Carver Road Sewer Extension Project, authorizing the City Manager, or his designee to enter into the associated Grant Agreement and execute all related documents and forwarding to Council for approval.
 Motion recommending the submission of a Safe and Affordable Drinking Water Program grant application to the State Water Resources Control Board to fund the Kiernan Ave Water Main Ext Project, authorizing the City Manager, or his designee to enter into the associated Grant Agreement and execute all related documents and forwarding to Council for approval.

UTILITIES; Jim Alves, 209-571-5557, [email protected]

NEW BUSINESS

5. Consider an Agreement for loan servicing with AmeriNational Community Services, LLC (dba AmeriNat) for loans funded through State and Federal funded programs for a - 4 -
4/29/2024
- 5 -
4/29/2024 4:00:00 PM
total amount not to exceed $250,000 over five (5) years and forwarding to Council for approval. (Funding Source: HUD Entitlement Funds)
 Motion recommending the Award of Bid and Agreement for loan servicing services to AmeriNational Community Services LLC (dba AmeriNat), for two (2) year Agreement with three (3) one-year extension options, for an estimated annual amount of $50,000 and a total amount not to exceed $250,000 over five years and authorizing the City Manager to execute the Agreement and forwarding to Council for approval.

CED; Edgar Garcia, 209-577-5211, [email protected]

6. Consider the Agreement for operational supplies with The Home Depot USA. Inc, for a total amount not to exceed $1,600,000 over five years and forwarding to Council for approval. (Funding Source: Various Funds)
 Motion recommending the Agreement for operational supplies to The Home Depot USA. Inc by utilizing the Competitive Bidding Process from Maricopa County, AZ for a two-year Agreement with three one-year extension options, for an annual estimated amount $320,000 and a total amount not to exceed $1,600,000 over five years; and forwarding to Council for approval.

FINANCE DEPARTMENT; Dianne Love, 209-571-5164, [email protected]

ADJOURNMENT
Posted pursuant to Government Code Section 54954.2 on the bulletin board at Tenth Street Place on at by
date time signature
- 5 -
4/29/2024

CITY OF MODESTO

COMMITTEE AGENDA REPORT
DATE OF MEETING:

April 29, 2024
Date: April 10, 2024
TO: Finance Committee
Nick Bavaro, Chair
Rosa Escutia-Braaton, Vice-Chair
David Wright, Member
FROM: Joseph P. Lopez, City Manager
SUBJECT: Monthly Budget Adjustment Report – April 2024
CONTACT: Steve Christensen, Budget Manager, [email protected] 209-577-5390
DESCRIPTION:

Consider the recommended budget adjustments to Fiscal Year 2023-24 Annual Operating and Capital Improvement Program Budgets; and forwarding to Council for approval. (Funding Source: Various Funds)
STRATEGIC PLAN ELEMENT:

This item supports the City of Modesto 2020-2025 Strategic Plan focus on Governance and Service Delivery under Goal H: Achieve Financial Sustainability.

BACKGROUND:

Each month staff presents a variety of budget adjustments requiring the approval of the City Council. These changes are submitted to the Finance Committee for review prior to submission to Council and include an explanation and justification for each transaction.

This report includes a number of adjustments that have been identified by monitoring department budgets. Due to the number of adjustments, they are included as an attachment to this report (Exhibit A). As in past reports, adjustments are segregated by fund and department as appropriate. The adjustments are reflected in a more summarized version and supporting documentation is available for review upon request.

Also included in this report as an attachment (Exhibit B) is a summary of the budget adjustments approved by the City Manager and/or Budget Manager consistent with the authority levels that was approved by Council with the passing of the Fiscal Year 2023-24 Operating Budget via Resolution No. 2023-267.
#1..
- 6 -
Finance Committee, April 29, 2024
Monthly Budget Adjustment Report – April 2024

Page 2 of 2 ends

DISCUSSION:

The monthly budget adjustments attached as Exhibit A in this item include adjustments across various departments. These adjustments are explained in further detail within Exhibit A.

FISCAL IMPACT:

The fiscal impact of each item is noted in the attachments to this report. The adjustments are for Fiscal Year 2023-24.

RECOMMENDED COMMITTEE ACTION:

Staff Recommendations:

Motion recommending the budget adjustments to Fiscal Year 2023-24 Annual Operating and Capital Improvement Program Budgets; and forwarding to Council for approval.

Approved by:

Joseph P. Lopez, City Manager
Attachments:

1. Exhibit A – Budget Adjustments Requiring Council Approval

2. Exhibit B – Staff Approved Budget Adjustments
#1..
- 7 -
Finance Committee, April 29, 2024
Monthly Budget Adjustment Report

EXHIBIT A
FISCAL YEAR 2023-24

COMMUNTIY AND ECONOMIC DEVELOPMENT
 A budget adjustment in the amount of $167,114 is necessary to re-establish/increase the revenue and expense budgets in Fund 1170 and project 101343 as it was previously budgeted in operating fund 1170 as part of the program year 2020/2021 HOME Investment Partnerships Program (HOME) grant entitlement funds. This amount reflects the available balance in HUD's (Department of Housing and Urban Development) reporting system and the allocation is from prior program years that have not yet been utilized. The funding will be used on administrative costs for a wide range of activities related to affordable housing. There is no impact to the General Fund.

PARKS, NEIGHBORHOODS AND RECREATION
 A budget adjustment in the amount of $127,500 is necessary to increase the General Fund revenue account 46006 – John Thurman Field Rental in Cost Center 34150, PRN – Event Services – John Thurman to account for the new rental agreement with The Baseball of Modesto, LLC which was approved by Council on 2/27/2024 per Resolution 2024-052. The agreement totals $360,000; $180,000 will be received in Fiscal Year 2023/2024 and the remaining $180,000 will be received in Fiscal Year 2024/2025. This will result in budgeted total of $197,500 which includes revenue received earlier in Fiscal Year 2023-2024 from the previous agreement.

PUBLIC WORKS-MEASURE L
 A budget adjustment in the amount of $550,460 is necessary in the Measure L – Capital Projects Fund (3300) to reduce the transfer in and expense budget from Project 101572 – HAWK 16th at H and I and Project 101573 – Advance School Beacons. The funds reduced from these projects are being reallocated to Project 101581 – Ethernet Switches. The funds are being reallocated as the projects have been completed and funding is needed to purchase ethernet switches for various signal locations. In additional the transfer out from Measure L – Road Tax Fund (1410) will be moved to the new project and will still be using funds from the Traffic Management category of Measure L funds.

UTILITIES
 A budget adjustment in the amount of $75,000 is necessary in the Water Fund (4100) to establish the expense budget for Project 101585 – PFAS Litigation. This Project will pay for legal expenses related to PFAS litigation. Due to the need to begin work on the project, a budget adjustment in the amount of $25,000 was completed on the Budget Manager’s authority. The adjustment will increase the budget by an additional $50,000 for a total project budget of $75,000.
 A budget adjustment in the amount of $100,546 is necessary in the Water Fund – CIP Projects (4180) to increase the expense budget for Project 101512 – South Modesto #1..
- 8 -
Finance Committee, February 26, 2024
Monthly Budget Adjustment Report

Page 2 of 2 ends

Areas Strengthen & Replace Water Mains – Phase 1 project. The increase in budget is necessary to match the Memorandum of Understanding with Stanislaus County for the City’s portion of the anticipated project construction expenses. #1..
- 9 -
Department Director/Budget Manager/City Manager Approved Budget Adjustments EXHIBIT B For FY2023/24
AT #
Approve
d by CM,
BM or
DD
Fund Fund Name Cost Ctr/Project Name Account Name Rev/Exp/TI/ TO Account
Current
Budget
Increase
(Decrease)
Revised
Budget Description
AT-101 CM 0100 General Fund Transfer Out Fund 0100 Transfer Out to Fund 3255 TO $ - 75,000 $ $ 75,000 A budget adjustment of $75,000 is necessary to increase professional services budget to cover formation invoices. Tivoli formation expenses will be reimbursed with the formation deposit. An Adjustment of $75,000 is also necessary to establish an interfund loan of $75,000 from General Fund 0100 to Tivoli CFD 3255.

AT-105 DD 0100 General Fund 35220 - Park Ops Salaries & Wages - Part-Time Exp $ 305,216 (100,837) $ $ 204,379 AT-105 DD 0100 General Fund 34130 - Parks Cultural Repair and Maintenance Exp $ 21,921 100,837 $ $ 122,758 AT-106 CM 0100 General Fund 02015 - CMO-Communications and Legislative Affairs
Budget Only - Salary Adjustment -
Decrease Exp $ 334,891 (42,000) $ $ 292,891
AT-106 CM 0100 General Fund 02015 - CMO-Communications and Legislative Affairs
Budget Only - Benefits Adjustment -
Decrease Exp $ 88,684 (28,000) $ $ 60,684
AT-106 CM 0100 General Fund 02015 - CMO-Communications and Legislative Affairs Marketing Services Exp $ 12,500 40,000 $ $ 52,500 AT-106 CM 0100 General Fund 02015 - CMO-Communications and Legislative Affairs Professional Services Exp $ 25,000 30,000 $ $ 55,000 AT-111 DD 0100 General Fund FIN - Purchasing Budget Only - Salary Adjustment - Decrease Rev $ - (7,000) $ $ (7,000)
AT-111 DD 0100 General Fund FIN - Purchasing Budget Only - Benefit Adjustment - Decrease Rev $ - (3,000) $ $ (3,000)
AT-111 DD 0100 General Fund FIN - Purchasing Conference Expenses Exp $ - 4,000 $ $ 4,000 AT-111 DD 0100 General Fund FIN - Purchasing Training Expenses Exp $ 600 2,000 $ $ 2,600 AT-111 DD 0100 General Fund FIN - Purchasing Temporary Employee Services Exp $ - 4,000 $ $ 4,000 Total Changes for Fund 0100 $ 788,812 $ 75,000 $ 863,812 AT-100 BM 1321 PEG Funds IT - Public Educational and
Governmental (PEG) PC Software and Supplies Exp $ 105,040 3,115 $ $ 108,155 A budget adjustment is necessary to increase the PEG Operations Cost Center to account for the annual service costs that were part of the agreement with MyTV26 for the Broadcast Server that was purchased. The service costs were agreed to be covered by the City for 5 years along with that purchase of the Broadcast Server via Council Resolution 2022-234.

Total Changes for Fund 1321 $ 105,040 $ 3,115 $ 108,155 AT-096 CM 1341 Grants-Reimbursed HD41 CA Recycle-PW Rev $ - 50,000 $ $ 50,000 AT-096 CM 1341 Grants-Reimbursed HD41 Appr C - Advertising Exp $ - 8,469 $ $ 8,469 AT-096 CM 1341 Grants-Reimbursed HD41 Appr C - Professional Services Exp $ - 21,000 $ $ 21,000 AT-096 CM 1341 Grants-Reimbursed HD41 Appr C - Business Expenses Exp $ - 1,533 $ $ 1,533 AT-096 CM 1341 Grants-Reimbursed HD41 Appr C - Svcs City Forces Exp $ - 18,998 $ $ 18,998 AT-107 CM 1341 Grants - Reimbursed 101586 - SB1383 (2024) Intergov - State - Ca recycle Rev $ - 569,930 $ $ 569,930 AT-107 CM 1341 Grants - Reimbursed 101586 - SB1383 (2024) Appr C - Advertising Exp $ - 80,000 $ $ 80,000 AT-107 CM 1341 Grants - Reimbursed 101586 - SB1383 (2024) Appr C - Equipment >$5,000 Exp $ - 332,944 $ $ 332,944 AT-107 CM 1341 Grants - Reimbursed 101586 - SB1383 (2024) Appr C - Professional Services Exp $ - 80,000 $ $ 80,000 AT-107 CM 1341 Grants - Reimbursed 101586 - SB1383 (2024) Appr C - Svcs City Forces Exp $ - 76,986 $ $ 76,986 AT-110 BM 1341 Grants - Reimbursed PW - Non-Capital Projects Interest Revenue on Bank Account Rev $ - 14,454 $ $ 14,454 AT-110 BM 1341 Grants - Reimbursed 101408 - SB1383 Local Assistance Grant Tools & Equipment > $5,000 Exp $ - 14,454 $ $ 14,454 Total Changes for Fund 1341 $ - $ 1,268,768 $ 1,268,768 AT-109 BM 1390 American Rescue Grants Fund 101459- LED Lighting Discretionary Expenses Exp $ 200,000 22,990 $ $ 222,990 AT-109 BM 1390 American Rescue Grants Fund 101459- LED Lighting Svcs City Forces Exp $ 50,000 (22,990) $ $ 27,010 Total Changes for Fund 1390 $ 250,000 $ - $ 250,000
A budget adjustment of $50,000 is necessary to receive a grant from the State of California for the Household Hazardous Waste Discretionary Grant Cycle 41 (HD41).

This grant will provide funding for staff time and collection material expense to begin a curbside battery recycling program for residential customers to dispose of the household batteries safely.

A budget adjustment is necessary to move Part-time Salary savings of $100,837 from Park Operations to fund Elevator Repairs at McHenry Mansion.

A budget adjustment is necessary to transfer salary savings of $70,000 from Appropriation Unit A in CMO-Communications and Legislative Affairs' division to fund marketing and professional services in Appropriation Unit C for the remainder of FY 2023-24.

A budget adjustment of $569,930 is necessary for the City of Modesto to receive a grant from the State of California for SB1383 round 2. These funds will be used to provide staff time, equipment, supplies, and education directly related to SB1383 activities.

A budget adjustment is necessary to reallocate budget between tasks. Net Zero impact on the overall budget.

A budget adjustment in the amount of $14,454 is needed to recognize revenue received from interest earned and to program offsetting expenses in a like amount.

A budget adjustment of $10,000 is necessary to move salary savings within the FINPurchasing cost center to cover underbudgeted training expenses and temp labor. #1..
- 10 -
Department Director/Budget Manager/City Manager Approved Budget Adjustments EXHIBIT B For FY2023/24
AT #
Approve
d by CM,
BM or
DD
Fund Fund Name Cost Ctr/Project Name Account Name Rev/Exp/TI/ TO Account
Current
Budget
Increase
(Decrease)
Revised
Budget Description
AT-101 CM 3255 Tivoli CFD Tivoli Formation Appr C Professional Services Exp $ 50,000 75,000 $ $ 125,000 AT-101 CM 3255 Tivoli CFD Transfer In Fund 3255 Transfer in from Fund 0100 TI $ - 75,000 $ $ 75,000 Total Changes for Fund 3255 $ 50,000 $ 150,000 $ 200,000 AT-103 BM 4100 Water Fund 101535 - PFAS Litigation Legal Services and Services City Forces - Interfund Exp $ - 25,000 $ $ 25,000
A budget adjustment is necessary to establish the initial project budget to pay for outstanding legal services invoices. The remainder of the budget will be included on a future monthly budget adjustment item.

Total Changes for Fund 4100 $ - $ 25,000 $ 25,000
AT-098 BM 4180 Water Fund - CIP Projects 101084 - Replacement Well 226 Surface Eng./Design/Admin Exp $ 620,420 (30,000) $ $ 590,420 AT-098 BM 4180 Water Fund - CIP Projects 101084 - Replacement Well 226 Surface Construction Administration Exp $ 252,996 30,000 $ $ 282,996 AT-099 BM 4180 Water Fund - CIP Projects 101367-Sylvan Water Main Upgrade Eng./Design/Admin Exp $ 77,947 (36,000) $ $ 41,947 AT-099 BM 4180 Water Fund - CIP Projects 101367-Sylvan Water Main Upgrade Construction Administration Exp $ 130,702 35,000 $ $ 165,702 AT-099 BM 4180 Water Fund - CIP Projects 101367-Sylvan Water Main Upgrade Consultant Charges Exp $ - 1,000 $ $ 1,000 AT-108 BM 4180 Water Fund - CIP Projects 100933 - 7th Street Bridge Water Main Construction Exp $ 1,000,000 (150,000) $ $ 850,000 AT-108 BM 4180 Water Fund - CIP Projects 100933 - 7th Street Bridge Water Main Eng./Design/Admin Exp $ 100,000 150,000 $ $ 250,000 Total Changes for Fund 4180 $ 2,182,065 $ - $ 2,182,065 A budget adjustment of $75,000 is necessary to increase professional services budget to cover formation invoices. Tivoli formation expenses will be reimbursed with the formation deposit. An Adjustment of $75,000 is also necessary to establish an interfund loan of $75,000 from General Fund 0100 to Tivoli CFD 3255.

A budget adjustment is necessary to reallocate funds between tasks to cover staff time and onsite non-warranty related equipment expenses. The overall project budget is not changing.

A budget adjustment is necessary to reallocate funds between tasks within the project. The overall project budget is not changing.

A budget adjustment is necessary to reallocate budget between task lines to cover expenses associated with the City's share of the design effort undertaken by the County. The overall budget is not changing.
#1..
- 11 -

CITY OF MODESTO

COMMITTEE AGENDA REPORT
DATE OF MEETING:

April 29, 2024
Date: March 1, 2024
TO: Finance Committee
Nick Bavaro, Chair
Rosa Escutia-Braaton, Vice Chair
David Wright
THROUGH: Joseph P. Lopez, City Manager
FROM: Bill Sandhu, Public Works Director
SUBJECT: Purchase Software Programming and License with Carahsoft Technology Corp.

CONTACT: Myriah Hill, Solid Waste Supervisor, [email protected], 209-577-5495 DESCRIPTION:

Consider the purchase of software programing and licensing with Carahsoft Technology Corp. of Reston, Virgina, for a total amount not to exceed $193,365 and forwarding to Council for approval. (Funding Source: Solid Waste Management Fund and SB 1383 Grant from CalRecycle)
STRATEGIC PLAN ELEMENT:

The recommended action supports the City’s 2020-2025 Strategic Plan Initiative: Quality of Life Goals and Strategies; engage partners across the community to ensure the safety, resilience, and attractiveness of Modesto; Goal D: Provide safe, efficient, and reliable infrastructure through proactive community investment, maintenance, and sustainability efforts; Strategy 4- Develop and implement a strategy to resolve illegal dumping and related nuisance abatement services.

BACKGROUND:

The Solid Waste Division is responsible for solid waste code enforcement throughout the City of Modesto, including illegal dumping in the public right of way, service violations, contamination, and other waste-related violations. Further, staff must maintain records on all waste collection, levels of services, inspections and route reviews, disposal sites, edible food recovery, waivers, shared containers, self-haul options, and related outreach and education, as required by the State of California’s waste enforcement agency, the Department of Resources, Recycling, and Recovery (CalRecycle).

This data is stored in numerous locations on the Solid Waste Shared Drive using both Microsoft Access and Excel. These databases are cumbersome and prone to errors and lost data. Access is used to store all data related to code enforcement and commercial customers but is not supported by the City of Modesto Information and Technology Department. When an error #2..
- 12 -
Finance Committee, April 29, 2024
Purchase Software Programming and License

Page 2 of 4 ends

occurs, the database must be manually re-booted, and staff are unable to access or enter new data until complete. Staff are also limited by the number and complexity of reports that can be generated through Access or Excel and by the total number of cases that can be entered. Each year has its own database, meaning that repeat violations may not be noticed and addressed appropriately.

Staff has identified the following areas where the current technology is insufficient or inefficient to track or create reports:
 Maintain records on code enforcement of both City and State laws.  Contain data for both commercial and residential waste service.  Develop notices using a standardized template.
 Include physical address, billing address, and units or suites for applicable locations.  Provide read-only or limited access to users.
 Track inspection, re-inspection, and route review data.  Time-stamped photographs.
 Track illegal dumping locations, reports, collection, and tonnages.  Track invoices created and revenue received or generated.  Interface with GIS.

The City of Modesto is required to report waste data to CalRecycle annually and, following the implementation of Senate Bill (SB) 1383, these reports are increasingly complicated and comprehensive. As the requirements of SB 1383 are fully implemented, the City will need to monitor all waste sorting education, outreach, and enforcement activities, mandated container inspections, and data collected on edible food recovery.

Staff also must use robust and reliable data in the development of new programs and to target education and outreach where it is most needed to comply with CalRecycle. For instance, as route reviews are conducted on residential containers and data entered an advance database, reports can be generated that would show an increase or decrease in contamination. This can provide direct feedback on the success of education programs or the need to adjust. Under current technology, staff must spend hours compiling data from various locations and processing it before such simple conclusions can be drawn.

On September 6, 2023, the Solid Waste Division presented this proposal to the Technology, Steering, and Alignment Committee (TSAC), which voted to move the project forward to a Council Committee by majority quorum vote.

DISCUSSION:

The Solid Waste Division researched vendors who would be able to provide the required services. Staff met with possible vendors to discuss needs and viable options. After reviewing available programs, staff determined that Salesforce, Inc. met all the City’s requirements.

Carahsoft Technology Corp. participated in a competitive bidding process with National Association of State Procurement Officials (NASPO ValuePoint) through the State of Utah that matched the requirements for the City of Modesto’s software needs.

On September 11, 2023, the City Manager authorized the Purchasing Manager to solicit the procurement for Purchase of Software Programming and License. On December 21, 2015, the State of Utah issued Request for Proposals (RFP) #CH16012 on behalf of the NASPO #2..
- 13 -
Finance Committee, April 29, 2024
Purchase Software Programming and License

Page 3 of 4 ends

ValuePoint, for Cloud Solutions on the BidSync online portal. On March 10, 2016, proposals were opened at the State of Utah Division of Purchasing 3150 State Office Building, Capitol Hill Salt Lake City, Utah 84114. Fifty-Eight proposals were received and based on the evaluation committee and criteria outlined in the RFP, 36 contracts were awarded for this commodity which includes Cloud Solutions. Based on the responsive and responsible proposer offering Cloud Solutions that met the minimum qualifications, technical qualifications methodology, approach, and cost scoring requirements. City staff recommends to award to Carahsoft Technologies Corp. of Reston, Virgina to purchase software programming and license for an amount not to exceed $193,365.

NASPO ValuePoint is a cooperative agency which streamlines the procurement process by developing RFPs for national competitive solicitations that meet or exceed local requirements.

The competitive process is continually refined to best meet agency needs and allows NAPSO ValuePoint to offer exceptional products from nationally acclaimed vendors.

Modesto Municipal Code Section 8-3.203 generally requires all purchases, which meet or exceed $100,000 for material, equipment, or contractual services to be formally bid. However, exceptions to the formal bidding process are granted in MMC 8-3.204(d) “Where the Purchasing Manager, in his or her discretion, determines that a process other than the formal bid procedure set for in Sections 8-3.203 will result in procurement for the City at the lowest possible cost commensurate with the desired quality.” In addition, MMC 8-3.202(h) encourages the Purchasing Manager to join with the State of California and other units of government in cooperative purchase plans when the best cost savings interest of the City could be served.

Both requirements were met based on the Competitive Bidding Process selected by NASPO.

FISCAL IMPACT:

The not to exceed cost of $193,365 includes a one-time development of customized software that meets the needs of the Solid Waste Division in the amount of $125,312 and one year of subscription to the provided software of $68,053. For ongoing maintenance and subscription after the first year, staff will return to Council for approval under software agreements. Funding is allocated from the Solid Waste Management Fund and from a SB 1383 Implementation grant provided by CalRecycle.

RECOMMENDED COMMITTEE ACTION:

Staff Recommendations:

Motion recommending the Competitive Bidding Process from NASPO through the State of Utah with Carahsoft Technologies Corp., Reston Virginia for purchase of software programing and licensing, for a total amount not to exceed $193,365 and forwarding to Council for approval. #2..
- 14 -
Finance Committee, April 29, 2024
Purchase Software Programming and License

Page 4 of 4 ends

Approved by:

Bill Sandhu, Public Works Director
Joseph P. Lopez, City Manager
Attachments:

1. Statement of Work - Carahsoft Technologies Corp.

2. Carahsoft Technologies Corp. Quote

3. Scoring Abstract from NASPO

4. NASPO RFP

5. Carahsoft Technologies Corp. RFP

6. TSAC Agenda for September 6, 2023
#2..
- 15 -
November 2022
CARAHSOFT TECHNOLOGY CORP.’S
Statement of Work ID# 42407762 for
City of Modesto
January 04
, 202
4 Carahsoft Q# 42407762
NASPO Cloud Solutions
CA: 7-17-70-40-05

SOLUTION PROVIDED BY
Carahsoft
CARAHSOFT TECHNOLOGY CORP.
11493 SUNSET HILLS ROAD, SUITE
100 RESTON, VA 20190
888.66.CARAH |
WWW.CARAHSOFT.COM
#2..
- 16 -
June 14, 2023
#2..
- 17 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] ● Participant Introductions
● Summit Technologies Introduction & Overview
● Requirements Discussion (deployment scoping)
● Questions
● Next Steps
agenda
#2..
- 18 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] biography
Josh Hines
Salesforce Consultant
[email protected]
Josh Hines is a senior consultant at Summit Technologies, where he plays a critical role in ensuring project success for clients. He works closely with clients to address their concerns and provides effective solutions. Josh also serves as a mentor to his colleagues. With a strong background in Salesforce, he is 8X certified and holds certifications in Field Service Consultant, Experience Cloud Consultant, and Nonprofit Cloud Consultant.

One of Josh's professional highlights was leading a workshop titled "Drive Service Transformation with Lightning and Digital Channels" at Dreamforce, the annual Salesforce conference. He graduated from DeVry University with a degree in Business Administration with a focus on Information Systems and has been working with Salesforce since 2014. Josh joined Summit Technologies in 2019 and brings a wealth of skills, including strong communication abilities, analytical and logical thinking, and an ability to adapt and learn quickly.

Aside from his professional achievements, Josh is a proud father to his daughter and has been happily married for over 15 years. He has a cockapoo named Tucker who loves to join him and his family on beach trips. Josh also has a remarkable accomplishment of receiving a Life-Saving Award from the Ohio House, Ohio Senate, County Sheriff Office, and County Commissioners for rescuing his mother and himself from a house fire. In his free time, Josh enjoys swimming, cooking, playing video games, and working on his Mustang. #2..
- 19 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] biography
Ted Chimiklis
Client Advisor and Board Member
[email protected]
Ted Chimiklis is a technology professional with over two and a half decades of expertise in IT sales, sales management, and operations. Throughout his career, he has worked at several fast-growing technology companies, including KnowledgWare, GIGA Information Group, Object Design, ServiceNow, Informatica, and Accela. He has made a significant impact on these companies by driving substantial revenue growth, which has led to successful IPOs or acquisitions.

Ted has held a range of management positions overseeing sales and operations in North America, APAC, and EMEA. At Object Design, he played a key role in establishing the Business Alliance Channel that resulted in a major partnership agreement and investment from IBM Software Group. He also held senior management positions at SEAGULL Software and Journee Software, where he established the initial sales teams to tap into new markets.

While at ServiceNow, Ted was responsible for leading the Southeast Area direct sales organization, acquiring customers such as Coca-Cola, Cox Communications, FedEx, and other Fortune 1000 companies. He led the East Commercial and SLED salesforce at Informatica and was the Executive Director of Emerging Markets, Public Sector at Accela. Currently, Ted serves as a Client Advisor and member of the Summit Technologies Advisory Board.
#2..
- 20 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] about
summit technologies
#2..
- 21 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] • Columbus-based Exclusive Salesforce Implementation
Partner
• Comple
ted 600+ Salesforce projects since 2016 with 200+
customers
• Successfully implemented Sales, Service, Experience,
Pardot, NPSP, EDA, Gov Foundation, and Marketing Clouds • 5 star rating on AppExchange
• Developed proprietary systems and processes to ensure project success
• De
veloped accelerators, getting to value faster
• Average of 5 Salesforce certifications per consultant • Committed to Salesforce best practices - low code or no code solutions
we are salesforce
platform &
product experts
#2..
- 22 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] we deliver a wide range of salesforce
solutions
Based in Columbus Ohio with
clients across North America
• Process automation and optimization (CRM, Case,
Grant, Sales, Licensing & Permitting, etc.)
• Post sales processes such as client onboarding and
project management
• Marketing automation using customer journeys,
outreach, social engagement, etc.
• Service and Case Management
• Field Service Management
• Customer and partner portals
• Digital engagement
• Contact center solutions
• Accounting, ERP, and other system integrations
• Licensing, Permits, and Inspections (LPI)
• Contract lifecycle management
#2..
- 23 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] summit technologies focus clouds & studios #2..
- 24 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] we know government services
and how to optimize your experience
#2..
- 25 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] Health Check
Evaluate your implementation and provide recommendations on: Security, Business Processes, Best Practices, Lightning Readiness, Data integrity, App check, Integration check, User adoption, and New features
Project IV&V
Independent verification and validation
(IV&V) of the implementation of current
Salesforce projects by internal staff or other
partners; Adherence to architecture,
requirements, and best practices
Center of Excellence Scaling
Build and train a balanced team of Salesforce professionals with the proper mix of resource talent; Establish a pipeline of fresh Salesforce talent
Managed Services
Administrative support to keep you running
post-go-live; Production break/fix and end-user
support services; Ongoing enhancement to
respond to user requests for functionality
adjustments; Strategic Salesforce visioning,
guidance and best practices
Strategic Services
Fractional CIO/CTO services; Strategic
Planning; Technology, Process, & People
roadmap; Thought leadership to guide and
advise on your current Roadmap, or master
plan; Update/Create a roadmap for how and
when to adjust the solution as business needs
change and as the platform evolves
Training
Custom-tailored Salesforce training
programs for beginner users, advanced
users, administrators, and IT professionals
our services
Project & Product Development
Full cycle implementation of your digital transformation initiative on the Salesforce platform – includes all software lifecycle disciplines: discovery, architecture, development, training, go-live support, etc.

Quick-Start
2 to 4 week implementation of the most popular Clouds; Tailor Salesforce to your unique requirements; Configure the most popular features, quick data import, and user training #2..
- 26 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] we partner with the leading apps
on the appexchange
#2..
- 27 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] our mission and core values
Innovation
Never settle, but seek what’s possible in
order to better meet the needs of our
community, employees, and customers
Integrity
Act with integrity and honesty, and focus on
putting ourselves in the shoes of others
Respect
Treat our employees and customers with
dignity and respect we should expect and
appreciate from others
Stewardship
Commit to excellence and leadership in our
specialty. Strive to be one of the best technology
solution providers, managing our business
profitably, providing value for our clients, and
opportunities for our employees through long-term
sustainable growth
Culture
Provide a working environment that fosters
ability to pursue and achieve company and
personal goals, and value the strength
gained from diversity
Community
Actively encourage and support
involvement with social programs that lift
our community
With our strong commitment to,
and investment in our people,
we deliver innovative solutions
that create value for our clients
and contribute to the
achievement of their goals
Mission
#2..
- 28 -
committed to your success
#2..
- 29 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] Run reports to sow hotspot dumping
maps, report inspections to State, how
many tags were issued, contamination
rate and compliance rate
Need to eliminate spreadsheets
and upgrade / migrate existing
databases
Need to automate all manual process
and reporting
Ability to schedule and route
inspectors on a daily basis , time
stamp photos, add re-inspections
Need portal access to track violations, setup case
numbers, tack payments and log cases
Need to be able to identify property by
physical address and units/suites for
both commercial and residential
what we heard Manage Code Enforcement Violations for City and State Laws - Hub for commercial and residential
accounts
1 2
3 4
5 6
7 #2..
- 30 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] Summit Technologies Implementation Services
Public Sector Implementation $48,000.00
Salesforce Maps $11,946.67
Document Generation & Conga Setup $13,738.67
Case Setup $8,960.00
Docusign Configuration $5,973.33
Data Loading Training and Support $2,986.67
Invoice Setup $14,933.33
Reports & Dashboards $5,973.33
Project Management $4,800.00
Architect $3,200.00
Training & Go Live Support $4,800.00
Total $125,312.00
services*
investment
summary
Presented 06/14/2023
#2..
- 31 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] Summit Technologies Implementation Services
Optional Services - Additional Cost:

One Year Managed Services (2 hours per month) $5,760.00 Data Loading handled by Summit $14,933.33
Total $20,693.33
services*
investment
summary
Presented 06/14/2023
Travel: If Travel is necessary a Change Order will be issued by Carahsoft #2..
- 32 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] Test &
Deploy
Support
Build
Train
Discovery
& Design
proposed implementation timeline
seven sprints (14 weeks)
Sprint 1
2 WEEKS
Sprint 2
2 WEEKS
Sprint 3
2 WEEKS
Sprint 4
2 WEEKS
Kick-off
Users &
Security
Public Sector Implementation
Deploy
Admin Training
Go-Live
1 WEEK
Sprint 5
2 WEEKS
Data
Verification Data Loading
End User Training
Sprint 6
2 WEEKS
Docusign
Configuration
User Acceptance Testing
Sprint 7
2 WEEKS
Reports & Dashboards
Go Live
Case Setup, Document Generation
#2..
- 33 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] our implementation strategy
We use a hybrid Agile / Waterfall approach for our projects • Initial discovery and business process review to flesh out MVP requirements
• Design, planning, project management and client
collaboration in our proprietary project workbook and
project management systems
• Two week sprints, most consisting of discovery, build, testing and deployment
• Project-specific User and Admin training
• User Acceptance Testing and deployment
• Final data loading (if needed) and Go-Live
• Post implementation support and further system expansion and improvement
discover
deploy
train
test
build
design
agile
process
#2..
- 34 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] Role Resource Profile & Responsibilities
Principal Salesforce
Consultant
▪ Provide delivery oversight and governance
▪ Ensure project governance meets quality standards
▪ Lead Business process workstream and Business Process Analyst ▪ Uncover Client’s business processes and requirements to ensure the solution addresses their specific needs and objectives
▪ Assist with Change Management to train end users
Project/Delivery Manager ▪ Develop a Project Plan with milestones & deliverables ▪ Work to resolve issues as appropriate, serve as first-level escalation point ▪ Manage project scope, schedule, budget, and Summit Technologies resources ▪ Coordinate day-to-day and milestone-based project activities ▪ Lead regular project status meetings and produces status reports Business Analyst ▪ Gather and document business processes and requirements, manages requirements ▪ Support workshops and preparing workshop documentation and deliverables ▪ Support test case definition, testing processes and test execution to confirm requirements are satisfied
▪ Responsible for quality of solution, testing functionality once developed or fixed ▪ Execute test plans/scripts during QA phase
▪ Track issues/bugs for resolution by development team
the summit technologies project team #2..
- 35 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] Role Resource Profile & Responsibilities
Salesforce Administrator ▪ Responsible for configuration and declarative development of the Salesforce platform ▪ Well-versed in Salesforce native functionality
Salesforce Developer ▪ Responsible for configuration and declarative development of the Salesforce platform ▪ Well-versed in Salesforce native functionality
▪ Use Apex, Visualforce and JavaScript to create unique customer-based solutions ▪ Create product integrations using API's, Apex and iPaaS technologies Salesforce Architect ▪ Design domain-specific, multi-cloud solutions on the Platform to power personalized, frictionless customer experiences that maximize business value ▪ Solve complex, large-scale customer challenges to produce secure, scalable, and high-performance solutions that maximize the full potential of the Platform ▪ Strategic advisor with focus on business transformation with domain expertise in functional, platform, and integration architecture
Data Architect ▪ Develop data migration approaches and scope including tools and data security ▪ Develop data mappings including data structures and formats based on existing object model, future state data model, and data set up and formats in external applications ▪ Collaborate with customers’ Data SME on data extraction efforts and loading/import of ▪ Collaborate with customers SMEs on data validation efforts including deduplication strategy, and necessary transformations before data ingestion into Salesforce the summit technologies project team #2..
- 36 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] Role Resource Profile & Responsibilities
Project Manager & Product
Owner
▪ Responsible for internal communication of overall project budget and timelines ▪ Communicates product vision and requirements
▪ Participates in upfront activities and preparation for workshops as the voice for business objectives and context
▪ Review and approve key project deliverables with stakeholders ▪ Serve as Summit Technologies’ primary point of contact ▪ Collaborate with Summit Technologies Project Manager to establish a project plan, milestones, and timelines
▪ Organize and coordinate Client internal resources and reviews/approvals ▪ Work to resolve issues with the Summit Technologies Project Manager Executive Sponsor ▪ Carry ultimate responsibility for the project ▪ Approve all changes to the project scope
▪ Provide additional funds for scope changes
▪ Approve project deliverables and milestones
Change Management Lead ▪ Establish change management plan based on Summit Technologies recommendations ▪ Execute change management plans (communication, training) ▪ Produce change management-related documentation (training manuals, end-user documentation, business process flows)
the client team – what we need from you #2..
- 37 -
555 s front st columbus oh 43215 • 614.859.6543 • [email protected] Role Resource Profile & Responsibilities
Core Team Members
(Various)
▪ Represent needs/objectives of respective business areas ▪ Participate in workshops and interviews
▪ Provide information regarding style guides
▪ Support/Review/Approve visual designs and overall user experience ▪ Provide feedback at specific intervals
▪ Assist in escalation of issues and roadblocks
▪ Plan/Conduct user acceptance testing activities
Supporting Business Function
Stakeholders & SMEs
▪ Provide insights/perspectives related to respective areas ▪ Participate in workshops and interviews
▪ Provide information regarding current state processes and challenges ▪ Participate in review and validation sessions
▪ Sponsor/Advocate/Support project activities (e.g. help facilitate making appropriate connections within their organizations to support data gathering and/or research activities) Technology Liaison ▪ Provide technology governance guidance and support ▪ Provide necessary support and access to other systems needed for this effort ▪ Broker dialog with vendor representatives of other systems and technologies that interface with this project
the client team – what we need from you #2..
- 38 -
success delivered
#2..
- 39 -
City of Modesto
Name:____________________
Signature:___________________
_
Title:__________________
Date:________________
Carahsoft Technology
Name:________________
Signature:______________
Title:_________________
Date:_________________
#2..
- 40 -

CONFIDENTIAL
PAGE 1 of 3
QUOTE DATE:

QUOTE NO:
01/04/2024
42407762
TO: Michele Hunt
City of Modesto
USA
EMAIL: [email protected]
PHONE:

FROM: Bailey McCummings
Carahsoft Technology Corp.
11493 Sunset Hills Road
Suite 100
Reston, Virginia 20190
EMAIL: [email protected]
PHONE: (571) 662-3422
TERMS: Contract Number: 7-17-70-40-05
NASPO Master Contract Number: AR2472
Contract Term: 09/15/17 - 09/15/26
Shipping Point: FOB Destination
Credit Cards: VISA/MasterCard/AMEX
Remit To: Same as Above
Payment Terms: Net 45 (On Approved Credit)
Sales Tax May Apply
QUOTE NO: 42407762
QUOTE DATE: 01/04/2024
QUOTE EXPIRES: 07/31/2024
RFQ NO:

SHIPPING: ESD
TOTAL PRICE: $193,364.48
TOTAL QUOTE: $193,364.48
LINE NO. PART NO. DESCRIPTION - QUOTE PRICE QTY EXTENDED PRICE

SALESFORCE LICENSES
1 200013349 Public Sector Foundation - Advanced - Enterprise Edition $2,112.00 COOP 24 $50,688.00 Salesforce.com, Inc. - 200013349
Start Date: 07/01/2024
End Date: 06/30/2025
2 200005696 Salesforce Shield 30% of Net Price $10,644.48 COOP 1 $10,644.48 Salesforce.com, Inc. - 200005696
Start Date: 03/04/2024
End Date: 03/03/2025
3 200001013 Salesforce Maps - Enterprise Edition $672.00 COOP 10 $6,720.00 Salesforce.com, Inc. - 200001013
Start Date: 07/01/2024
End Date: 06/30/2025
SALESFORCE LICENSES SUBTOTAL: $68,052.48

SUMMIT TECHNOLOGIES SERVICES
4 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW $48,000.00 COOP 1 $48,000.00 Required.

Public Sector Implementation
Carahsoft Technology Corporation - AR2472-CAR001-103
5 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW $11,946.67 COOP 1 $11,946.67 Required.

Salesforce Maps
Carahsoft Technology Corporation - AR2472-CAR001-103
6 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW $13,738.67 COOP 1 $13,738.67 Required.

Document Generation & Conga Setup
Carahsoft Technology Corporation - AR2472-CAR001-103
7 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW $8,960.00 COOP 1 $8,960.00 Required.

Case Setup
Carahsoft Technology Corporation - AR2472-CAR001-103
8 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW $5,973.33 COOP 1 $5,973.33 Required.

Docusign Configuration
Carahsoft Technology Corporation - AR2472-CAR001-103
#2..
- 41 -

CONFIDENTIAL
PAGE 2 of 3
QUOTE DATE:

QUOTE NO:
01/04/2024
42407762
LINE NO. PART NO. DESCRIPTION - QUOTE PRICE QTY EXTENDED PRICE 9 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW Required.

Data Loading Training and Support
Carahsoft Technology Corporation - AR2472-CAR001-103
$2,986.67 COOP 1 $2,986.67
10 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW Required.

Invoice Setup
Carahsoft Technology Corporation - AR2472-CAR001-103
$14,933.33 COOP 1 $14,933.33
11 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW Required.

Reports & Dashboards
Carahsoft Technology Corporation - AR2472-CAR001-103
$5,973.33 COOP 1 $5,973.33
12 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW Required.

Project Management
Carahsoft Technology Corporation - AR2472-CAR001-103
$4,800.00 COOP 1 $4,800.00
13 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW Required.

Architect
Carahsoft Technology Corporation - AR2472-CAR001-103
$3,200.00 COOP 1 $3,200.00
14 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW Required.

Training & Go Live Support
Carahsoft Technology Corporation - AR2472-CAR001-103
$4,800.00 COOP 1 $4,800.00
SUMMIT TECHNOLOGIES SERVICES SUBTOTAL: $125,312.00
SUBTOTAL: $193,364.48
TOTAL PRICE: $193,364.48
TOTAL QUOTE: $193,364.48

SUGGESTED OPTIONS
LINE NO. PART NO. DESCRIPTION - QUOTE PRICE QTY EXTENDED PRICE

SUMMIT TECHNOLOGIES SERVICES (OPTIONAL)
15 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW Required.

One Year Managed Services (2 hours per month)
Carahsoft Technology Corporation - AR2472-CAR001-103
$5,760.00 COOP 1 $5,760.00
16 AR2472-CAR001-103 Custom Professional Services. Scoped Milestone. SOW Required.

Data Loading handled by Summit
Carahsoft Technology Corporation - AR2472-CAR001-103
$14,933.33 COOP 1 $14,933.33
SUGGESTED SUBTOTAL: $20,693.33
#2..
- 42 -

CONFIDENTIAL
PAGE 3 of 3
QUOTE DATE:

QUOTE NO:
01/04/2024
42407762
Customer must reference Quote #42407762 and NASPO Cloud Solutions Contract 7-17-70-40-05 on PO ***Please see attached SOW for Service Terms***
-----------------------
Product Special Terms
Salesforce Inbox
In order to access Salesforce Inbox, it must be activated by the Customer'ssystem administrator via the following link: https://appexchange.salesforce.com/listingDetail? listingId=a0N3000000CNj52EAD
Emergency Program Management
In order to access Emergency Program Management Services, Customer’s system administrator must first install the managed package via the following link:
http://industries.force.com/publicsector.

Public Sector Foundation - Advanced
In order to access Omnistudio features and functionality, Customer’s system administrator must first install the latest OmniStudio managed package available at:
https://help.salesforce.com/s/articleView?id=sf.os_omnistudio_release_summary_for_installation_and_upgrade.htm&type=5.

Salesforce Maps
In order to use the Salesforce Maps Services, Customer'ssystem administrator must first install the managed package (available at https://sfdc.co/SFMapsInstall).

Salesforce Shield
In order to use the Data Detect features, Customer’ssystem administrator mustfirst install the managed package available at: https://sfdc.co/install-datadetect.

Einstein Features
SFDC may access Customer Data submitted to the Einstein features for the purpose of improving and training services and features Customer may access, and Customer instructs SFDC to process its Customer Data for such purpose. Customer retains all ownership of its Customer Data and SFDC retains all ownership in and to aggregated machine learning results.
--------------------
Customer must reference Quote number and Contract # on Purchase Order.

Should Customer purchase via Reseller all terms of Carahsoft Quote must be incorporated in Reseller quote and Customer Purchase Order to Reseller.

Any increase in subscription pricing (excluding support and resource-based Services) for the first renewal term will be in accordance with SFDC's pricing and policies in effect at the time of the renewal or as otherwise agreed to by the parties or noted in these quote terms or contract Licensee agrees that any order for Salesforce Services will be governed by the terms and conditions of the Carahsoft Salesforce Service Terms, copies of which are found at https://carah.io/SFDC-TOU and all Schedules and Documentation referenced by the Terms are made a part hereof. The parties agree that any term or condition stated in a Customer purchase order or in any other Customer order documentation (excluding Quotes) is void. In the event of any conflict or inconsistency among the following documents, the order of precedence shall be: (1) the applicable Quotes (and their Contract Vehicle), (2) the TOU, and (3) the Documentation. Licensee acknowledges it has had the opportunity to review the Terms, prior to executing an order.

Product Terms Directory: http://carah.io/Product-Terms-Directory Help & Training: http://carah.io/Help
Government Cloud Plus: http://www.carahsoft.com/government-cloud-terms A list of currently available FedRAMP/IL4 Authorized Salesforce products can be found here: https://help.salesforce.com/articleView?id=000270080&language=en_US&type=1 #2..
- 43 -
Cost Scores AT&T ATOS Inc Carahsoft CDW Govt. Century Link CGI Cisco Sys CSRA Day 1 Solutions
Cost
147.2 Cost Points 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 Score Summary AT&T ATOS Inc Carahsoft CDW Govt. Century Link CGI Cisco Sys CSRA Day 1 Solutions
Total Technical Points (Total Possible = 1325) 929.2 935.8 934.2 936.7 966.7 937.5 977.5 1003.3 1034.2 Total Cost Points (Total Possible = 147.2) 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 Grand Total Points (Total Possible = 1472.2) 1076.4 1083.0 1081.4 1083.9 1113.9 1084.7 1124.7 1150.5 1181.4 Total
Cost
Points
DLT Solutions Emergent
Environmental
Sys. Research
(ESRI)
IBM Info Reliance Insight Public
Sector Logicworks Oracle America SHI Smartronix
Strategic
Communicati
on
TCC Software
Solutions Unisys Vmware Inc Cherry Road
147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 DLT Solutions Emergent
Environmental
Sys. Research
(ESRI)
IBM Info Reliance Insight Public
Sector Logicworks Oracle America SHI Smartronix
Strategic
Communicati
on
TCC Software
Solutions Unisys Vmware Inc Cherry Road
1001.7 935.0 975.0 1029.2 1043.3 927.5 928.3 955.0 976.7 1043.3 1025.0 969.2 974.2 1001.7 929.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 1148.9 1082.2 1122.2 1176.4 1190.5 1074.7 1075.5 1102.2 1123.9 1190.5 1172.2 1116.4 1121.4 1148.9 1076.4 Vendor A Vendor B Vendor C Vendor D Vendor E Vendor F Vendor G Vendor H Vendor I A&T Systems EMC Corp. IMMX Group NTT Data Inc Verizon Vendor J

0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 147.2 147.2 147.2 147.2 147.2 0.0 Vendor A Vendor B Vendor C Vendor D Vendor E Vendor F Vendor G Vendor H Vendor I A&T Systems EMC Corp. IMMX Group NTT Data Inc Verizon Vendor J 886.7 848.3 851.7 650.0 820.0 842.5 899.2 867.5 827.5 1037.5 993.3 966.7 1020.0 957.5 865.0

0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 147.2 147.2 147.2 147.2 147.2 0.0 886.7 848.3 851.7 650.0 820.0 842.5 899.2 867.5 827.5 1184.7 1140.5 1113.9 1167.2 1104.7 865.0 Teradata Collab9 Inc Contact
Solutions Broadvoice FireEye GuideSoft Quest Retarus Workday Vendor K Vendor L Vendor M Vendor N 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 0.0 0.0 0.0 0.0 Teradata Collab9 Inc Contact
Solutions Broadvoice FireEye GuideSoft Quest Retarus Workday Vendor K Vendor L Vendor M Vendor N 932.5 948.3 985.0 902.5 911.7 951.7 916.7 950.8 892.5 875.0 880.8 849.2 848.3 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 147.2 0.0 0.0 0.0 0.0 1079.7 1095.5 1132.2 1049.7 1058.9 1098.9 1063.9 1098.0 1039.7 875.0 880.8 849.2 848.3 #2..
- 44 -
5 6
Solicitation CH16012
NASPO ValuePoint Cloud Solutions
Bid Designation: Public
State of Utah
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 1
#2..
- 45 -
5 Bid CH16012
NASPO ValuePoint Cloud Solutions
Bid Number    CH16012
Bid Title    NASPO ValuePoint Cloud Solutions
Bid Start Date Dec 21, 2015 11:15:04 AM MST
Bid End Date Mar 10, 2016 1:00:00 PM MST
Question &
Answer End Date Jan 29, 2016 12:00:00 PM MST
Bid Contact    Christopher Hughes
Contracts Analyst
DAS
801-538-3254
[email protected]
Contract Duration    See Specifications
Contract Renewal    See Specifications
Prices Good for    Not Applicable
Bid Comments The State of Utah, Division of Purchasing (Lead State) is requesting proposals for cloud solutions in furtherance of the NASPO ValuePoint Cooperative Purchasing Program. The purpose of this Request for Proposals (RFP) is to establish Master Agreements with qualified Offerors to provide services related to cloud solutions for all Participating Entities. The objective of this RFP is to obtain best value, and achieve more favorable pricing, than is obtainable by an individual state or local government entity because of the collective volume of potential purchases by numerous state and local government entities. The Master Agreement(s) resulting from this procurement shall be extended to state governments (including departments, agencies, institutions), institutions of higher education, political subdivisions (i.e., colleges, school districts, counties, cities, etc.), the District of Columbia, territories of the United States, and other eligible entities subject to approval of the individual state procurement director and compliance with local statutory and regulatory provisions. The initial term of the Master Agreement shall be ten (10) years with no renewal provisions; however, Contract Vendors must submit an annual certification that they are still compliant with the mandatory minimum requirements and technical specification of the RFP.

Each state, territory, and participating entity is unique in how they currently employ cloud solutions; some are utilizing cloud solutions to augment services that their technology departments provide to end users and some have not entered the realm of outsourcing technical solutions to cloud solutions providers. This cooperative procurement effort’s objective is to provide states, territories, and their authorized political subdivisions with high quality cloud based service providers that have the ability to provide a menu of cloud solutions offerings that will ultimately increase the technology department’s overall efficiency, reduce costs, improve operational scalability, provide business continuity, increase collaboration efficiencies, and allow for expanded flexibility in work practices and system improvements.

The resulting Master Agreement contract(s) will provide Participating Entities with access to technical capabilities that run in cloud environments and meet the NIST Essential Characteristics. Sub-categories in scope are the three NIST Service Models, Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS).

The awarded contracts will allow Participating Entities to choose cloud solutions that meet the following descriptions:

Commercially available cloud computing services
Meets the National Institute for Standards and Technology (NIST) definition of Cloud Computing Open to all deployment models (private, public, community or hybrid), vendors specify deployment models
Added on Dec 22, 2015:

Please do not contact the State of Utah Division of Purchasing. All questions must be posted on Bidsync.

Attachment H has been uploaded to this solicitation.

Added on Dec 24, 2015:

Solicitation has been revised to include the State of Vermont's Terms and Conditions.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 2
#2..
- 46 -
Open to all deployment models (private, public, community or hybrid), vendors specify deployment models
Added on Dec 22, 2015:

Please do not contact the State of Utah Division of Purchasing. All questions must be posted on Bidsync.

Attachment H has been uploaded to this solicitation.

Added on Dec 24, 2015:

Solicitation has been revised to include the State of Vermont's Terms and Conditions.

Added on Jan 5, 2016:

This addendum adds the Exhibits to Attachment B as separate documents.

Added on Jan 12, 2016:

The contract signature page has been uploaded as "Vendor Info Form". Please complete this document, sign it, and attach it to your proposal.

Added on Jan 15, 2016:

Louisiana has provided its intent to participate.

And the Commonwealth of Virginia has revised its Intent to Participate which includes Virginia's Terms and Conditions.

Added on Jan 28, 2016:

This addendum is being provided to inform Offerors that the State of Alabama has provided its intent to participate in this RFP.

Added on Feb 1, 2016:

Florida has submitted an Intent to Participate in this solicitation.

Added on Feb 3, 2016:

The following documents have been amended: Cloud Solutions - Request for Proposals - CH16012 (final), Attachment A - NASPO ValuePoint Master Agreement Terms and Conditions (final), Attachment G - Cost Proposal (final), and Attachment H - Identification of Service Models (final). Offerors should review all of the new documents.

The Request for Proposals document was modified in response to questions posted during the Q&A period. In particular Sections 5, 6, 7, 8, and 9 have been modified.

Attachment A, G, and H were modified in response to questions posted during the Q&A period.

Also, Attachment F has been deleted.

In addition, an Acknowledgement of Amendments to the RFP has been created. Offerors must complete and return this document as part of its proposal.

Offerors should download a new packet.

Added on Feb 5, 2016:

The "Cloud Solutions - Request for Proposals - CH16012final.docx" and the "CH16012 - Score Sheet.xls" were modified to reflect that the total possible point for an Offeror's technical response is 1325 points.

Offerors are encouraged to read Section 4.3.2.

Added on Feb 10, 2016:

The End Date for this Solicitation has been extended from February 26, 2016 to March 10, 2016 at 1:00 pm MTN.

The RFP document as been modified and a new document has been uploaded "Cloud Solutions - Request for Proposals - CH16012(final) - 02102016". Offerors should use this document in responding to the solicitation.

Also the Acknowledgement of Amendments to the RFP has been updated to "ACKNOWLEDGEMENT OF AMENDMENTS TO RFP (final) - 02102016". Offers should attach this document in responding to this RFP.

Addendum # 1
New Documents           Attachment H - Identification of Service Models.docx Addendum # 2
New Documents           VT terms for BGS multistate procurements 10Dec2015.pdf Addendum # 3
New Documents           Exhibit 1 to Attachment B - CAIQ v3.0.1-09-16-2014.xlsx Exhibit 2 to Attachment B - CSA_CCM_v3.0.1-09-16-2014.xlsx Addendum # 4
New Documents           Vendor Info Form.docx
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 3
#2..
- 47 -
Addendum # 4
New Documents           Vendor Info Form.docx
Addendum # 5
New Documents           Louisiana - Intent to Participate.pdf Virginia - Intent to Participate - Revision.pdf
Addendum # 6
Addendum # 7
Addendum # 8
New Documents           ACKNOWLEDGEMENT OF AMENDMENTS TO RFP final.docx Attachment H - Identification of Service Models final.docx Attachment A - NASPO ValuePoint Master Agreement Terms and Conditions final.docx Attachment G - Cost Proposal final.docx
Cloud Solutions - Request for Proposals - CH16012final.docx CH16012 - Score Sheet.xls
Removed Documents    Attachment A - NASPO ValuePoint Master Agreement Terms and Conditions.docx Attachment F - Usage Report Summary - Sample - NASPO ValuePoint.xlsx Attachment G - Cost Proposal.docx
CH16012 - Score Sheet.xls
Cloud Solutions - Request for Proposals - CH16012.docx
Attachment H - Identification of Service Models.docx
Addendum # 9
New Documents           Cloud Solutions - Request for Proposals - CH16012final.docx CH16012 - Score Sheet.xls
Removed Documents    Cloud Solutions - Request for Proposals - CH16012final.docx CH16012 - Score Sheet.xls
Addendum # 10
New Documents           ACKNOWLEDGEMENT OF AMENDMENTS TO RFP final - 02102016.docx Cloud Solutions - Request for Proposals - CH16012final - 02102016.docx Removed Documents    ACKNOWLEDGEMENT OF AMENDMENTS TO RFP final.docx Cloud Solutions - Request for Proposals - CH16012final.docx Previous End Date    Feb 26, 2016 1:00:00 PM MST New End Date    Mar 10, 2016 1:00:00 PM MST Item Response Form
Item     CH16012--01-01 - Cloud Solutions
Quantity    1 n/a
Unit Price
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 4
#2..
- 48 -
6 Item     CH16012--01-01 - Cloud Solutions
Quantity    1 n/a
Unit Price
Delivery Location          State of Utah
No Location Specified
Qty 1
Description
NASPO ValuePoint Cooperative Purchasing Program, facilitated by the NASPO Cooperative Purchasing Organization LLC, a 501(c)(3) limited liability company (doing business as NASPO ValuePoint) is a subsidiary organization the National Association of State Procurement Officials (NASPO), the sole member of NASPO ValuePoint.  The NASPO ValuePoint Cooperative Purchasing Organization facilitates administration of the cooperative group contracting consortium of state chief procurement officials for the benefit of state departments, institutions, agencies, and political subdivisions and other eligible entities (i.e., colleges, school districts, counties, cities, some nonprofit organizations, etc.) for all states and the District of Columbia. The NASPO ValuePoint Cooperative Development Team is identified in the Master Agreement as the recipient of reports and may be performing contract administration functions as assigned by the Lead State. State of Utah Bid CH16012 3/22/2016 4:23 PM p. 5
#2..
- 49 -
5 6

STATE OF UTAH
SOLICITATION NO. CH16012
NASPO ValuePoint Cloud Solutions
RESPONSES DUE NO LATER THAN:

Mar 10, 2016 1:00:00 PM MST
RESPONSES MAY BE SUBMITTED ELECTRONICALLY TO:
www.bidsync.com
RESPONSES MAY BE MAILED OR DELIVERED TO:

State of Utah
Division of Purchasing
3150 State Office Building, Capitol Hill
Salt Lake City, Utah 84114-1061
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 6
#2..
- 50 -
5 State of Utah
Request for Proposal
Legal Company Name (include d/b/a if applicable) Federal Tax Identification Number
State of Utah Sales Tax ID
Number
Ordering Address City State Zip Code
Remittance Address (if different from ordering address) City State Zip Code Type
Corporation Partnership Proprietorship Government Company Contact Person
Telephone Number (include area code) Fax Number (include area code) Company’s Internet Web Address Email Address
Discount Terms (for prompt payment discounts): Days Required for Delivery After Receipt of Order (see attached for any required minimums)
By submitting a proposal in response to this RFP, the Offeror acknowledges and agrees that the specifications, terms and conditions, or other elements of the RFP are not ambiguous, confusing, contradictory, unduly restrictive, erroneous, or anticompetitive. The Offeror further acknowledges that it has read this RFP, along with any attached or referenced documents, and this document, including the General Provisions.

Offeror’s Authorized Representative’s Signature Date
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 7
#2..
- 51 -

N O T I C E
When submitting a proposal electronically through BidSync, it is the sole responsibility of the Offeror to ensure that the proposal is received by BidSync prior to the closing date and time. Each of the following steps in BidSync MUST completed in order to place an offer:

A. Login to www.bidsync.com;
B. Locate the bid (solicitation) to which you are responding; a. Click the “Search” tab on the top left of the page;
b. Enter keyword or bid (solicitation) number and click “Search”; C. Click on the “Bid title/description” to open the Bid (solicitation) Information Page; D. “View and Accept” all documents in the document section; E. Select “Place Offer” found at the bottom of the page; F. Enter your pricing, notes, and other required information and upload attachments to this page; G. Click “Submit” at the bottom of the page;
H. Review Offer(s); and
I. Enter your password and click “Confirm”.

Note that the final step in submitting a proposal involves the Offeror’s acknowledgement that the information and documents entered into the BidSync system are accurate and represent the Offeror’s actual proposal. This acknowledgement is registered in BidSync when the Offeror clicks “Confirm”. BidSync will post a notice that the proposal has been received.

This notice from BidSync MUST be recorded prior to the closing date and time or the proposal will be considered late and will not be accepted.

Be aware that entering information and uploading documents into BidSync may take considerable time. Please allow sufficient time to complete the online forms and upload documents. Offerors should not wait until the last minute to submit a proposal. It is recommended that Offerors submit proposals a minimum of 24 hours prior to the closing date and time. The deadline for submitting information and documents will end at the closing time indicated in the solicitation. All information and documents must be fully entered, uploaded, acknowledged (Confirm) and recorded into BidSync before the closing date and time or the system will stop the process and the proposal will be considered late and will not be accepted.

Proposals submitted in BidSync are completely secure. No one (including the Division of Purchasing) can see proposals until after the closing date and time. Offerors may modify or change their proposals at any time prior to the closing date and time. However, all modifications or changes must be completed and acknowledged (Confirm) in the BidSync system prior to the closing date and time. BidSync will post a notice that the modification/change (new offer) has been received. This notice from BidSync MUST be recorded prior to the closing date and time or the response will be considered late and will not be accepted.

Section 46-4-402(2) of the Utah Code provides that unless otherwise agreed between a sender (Offeror) and the recipient (Division of Purchasing), an electronic record is received when: (a) it enters an information processing system that the recipient has designated or uses for the purpose of receiving electronic records or information of the type sent and from which the recipient is able to retrieve the electronic record; and (b) it is in a form capable of being processed by that system Type or Print Name Position or Title
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 8
#2..
- 52 -

This notice from BidSync MUST be recorded prior to the closing date and time or the proposal will be considered late and will not be accepted.

GENERAL PROVISIONS

1. GOVERNING LAWS: All purchases made under this Request for Proposals (RFP) are subject to the Utah Procurement Code and the applicable State of Utah Administrative Code. These are available at www.purchasing.utah.gov. By submitting a proposal, the Offeror warrants that it and the procurement item(s) purchased under this RFP comply fully with all applicable Federal and State laws and regulations, including applicable licensure and certification requirements.

2. SUBMITTING A PROPOSAL: By submitting a proposal in response to this RFP, the Offeror acknowledges that the minimum requirements, technical specifications, scope of work, and the evaluation process, outlined in this RFP are fair, equitable, not unduly restrictive, and understood. Any exceptions to the content of this RFP, including the specifications and minimum requirements, must be addressed during the Question and Answer period or protested in writing to the Division of Purchasing before the closing date and time.

3. EVALUATION: The evaluation of the Offeror’s proposal shall be conducted in accordance with Part 7 of the Utah Procurement Code.

An evaluation committee may ask questions of Offerors to clarify proposals provided the questions are submitted and answered in writing. The record of questions and answers shall be maintained in the file.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 9
#2..
- 53 -
recipient has designated or uses for the purpose of receiving electronic records or information of the type sent and from which the recipient is able to retrieve the electronic record; and (b) it is in a form capable of being processed by that system

GENERAL PROVISIONS

3. EVALUATION: The evaluation of the Offeror’s proposal shall be conducted in accordance with Part 7 of the Utah Procurement Code.

4. BEST AND FINAL OFFERS: At any time during the evaluation process, the evaluation committee, with the approval of the director or head of the issuing procurement unit, may request best and final offers from responsible and responsive offerors in accordance with Part 7 of the Utah Procurement Code and applicable administrative rules, and evaluate those offers. If an offeror chooses not to participate in discussion or does not make a timely best and final offer, its immediately previous proposal will be treated as the offeror best and final offer.

5. BRAND NAME OR EQUAL SPECIFICATION: Wherever in this RFP an item is defined by using a trade name, brand name, or a manufacturer and/or model number, it is intended that the words, “or equivalent” apply; and invites the submission of equivalent products by the Offerors.

6. SAMPLES: Samples of item(s) specified in this offer, brochures, etc., when required by this RFP, must be furnished free of expense to the State of Utah. Any item not destroyed by tests may, upon request made at the time the sample is furnished, be returned at the Offeror's expense.

7. DEBRIEFING OF UNSUCCESSFUL OFFERORS: The Utah Division of Purchasing does not conduct debriefings nor collect detailed explanations of evaluator’s scores.

8. DEBARMENT: By submitting a proposal, the Offeror certifies that neither it nor its principals are presently debarred, suspended, proposed for debarment, declared ineligible or voluntarily excluded from participation in this transaction (contract) by any governmental department or agency. If the Offeror cannot certify this statement, attach a written explanation for review by the State.

9. ENERGY CONSERVATION AND RECYCLED PRODUCTS: The Offeror is encouraged to offer Energy Star certified products or products that meet Federal Energy Management Program (FEMP) standards for energy consumption. The State also encourages contractors to offer products that are produced with recycled materials, where appropriate, unless otherwise requested in this RFP.

10. SALES TAX ID NUMBER: Utah Code Annotated (UCA) 59-12-106 requires anyone filing a proposal with the state for the sale of tangible personal property or any other taxable transaction under UCA 59-12-103(1) to include their Utah sales tax license number with their proposal. For information regarding a Utah sales tax license see the Utah State Tax Commission’s website at www.tax.utah.gov/sales. The Tax Commission is located at 210 North 1950 West, Salt Lake City, UT 84134, and can be reached by phone at (801) 297-2200.

11. PROTESTS: Pursuant to Utah Code §63G-6a-1602, an Offeror may: (1) protest the rejection of their proposal; (2) protest an alleged grievance in connection with the procurement process; or (3) protest an alleged grievance in connection with the award of a contract.

Protests must be made to the State of Utah Chief Procurement Officer. A notice of protest must be submitted either: (1) before the closing of date of the proposals, as provided on Bidsync; or (2) if the person filing the protest did not know and should not have known of the facts giving rise to the protest before the closing date for proposals, within seven days after the day on which the person knows or should have known of the facts giving rise to the protest. All protests must be submitted in accordance with Part 16 of Utah Procurement Code and applicable administrative rules.

In accordance with the requirements set forth in Section 63G-6a-1602(2)(b), a person filing a protest must include a concise statement of the grounds upon which the protest is made. A concise statement of the grounds for a protest should include the relevant facts leading a protestor to contend that a grievance has occurred, including but not limited to specifically referencing: (i) an alleged violation of Utah Procurement Code 63G-6a; (ii) an alleged violation of Administrative Rule R33 or other applicable rule; (iii) a provision of the request for proposals, invitation for bids, or other solicitation allegedly not being followed; (iv)a provision of the solicitation alleged to be: ambiguous, confusing, contradictory, unduly restrictive, erroneous, anticompetitive, or unlawful; (v) an alleged error made by the evaluation committee or conducting procurement unity; (vi) an allegation of bias by the committee or an individual committee member; or (vii) a scoring criteria allegedly not being correctly applied or calculated.

None of the following qualify as a concise statement of the grounds for a protest:
(i) claims made after the opening of bids or closing date of proposals that the specifications, terms and conditions, or other elements of a solicitation are ambiguous, confusing, contradictory, unduly restrictive, erroneous, or anticompetitive; (ii) vague or unsubstantiated allegations that do not reference relevant or specific facts including, but not limited to, vague or unsubstantiated allegations by a bidder, offeror, or prospective contractor that: (A) a bidder, offeror, or prospective contractor should have received a higher score or that another bidder, offeror, or prospective contractor should have received a lower score, (B) a service or product provided by a bidder, offeror, or prospective contractor is better than another bidder’s, offeror or prospective contractor’s service or product, (C) another bidder, offeror, or prospective contractor cannot provide the procurement item for the price bid or perform the services described in the solicitation, or (D) any other item that is not relevant or specific; or
(iii) filing a protest requesting: (A) a detailed explanation of the thinking and scoring of evaluation committee members, beyond the official justification statement described in Section 63G-6a-708, (B) protected information beyond what is provided under the disclosure provisions of the Utah Procurement Code; or (C) other information, documents, or explanations reasonably deemed to be not in compliance with the Utah Code or Administrative Rule R33 by the protest officer.

In accordance with Section 63G-6a-1603(3)(a), a protest officer may dismiss a protest if the concise statement of the grounds for filing a protest does not provide an adequate basis for the protest.

12. AUDIT: Pursuant to Administrative Rule R33-12-605, the State may, at reasonable times and places, audit or cause to be audited by an independent third party firmby another procurement unitor by an agent of the procurement unitthe bookrecordsand performance State of Utah Bid CH16012
3/22/2016 4:23 PM p. 10
#2..
- 54 -
6 (iii) filing a protest requesting: (A) a detailed explanation of the thinking and scoring of evaluation committee members, beyond the official justification statement described in Section 63G-6a-708, (B) protected information beyond what is provided under the disclosure provisions of the Utah Procurement Code; or (C) other information, documents, or explanations reasonably deemed to be not in compliance with the Utah Code or Administrative Rule R33 by the protest officer.

In accordance with Section 63G-6a-1603(3)(a), a protest officer may dismiss a protest if the concise statement of the grounds for filing a protest does not provide an adequate basis for the protest.

12. AUDIT: Pursuant to Administrative Rule R33-12-605, the State may, at reasonable times and places, audit or cause to be audited by an independent third party firm, by another procurement unit, or by an agent of the procurement unit, the book, records, and performance of the Offeror, if awarded a contract under this RFP.

13. INSPECTIONS: Pursuant to Utah Administrative Rule R33-12-701, R33-12-702, R33-12-703, and R33-12-704, the State may, at its discretion, perform an inspection of the Offeror’s manufacturing/production facility or place of business, or any location where the work is performed.

14. MODIFICATION OR WITHDRAWAL OF PROPOSAL: A proposal may be modified or withdrawn prior to the established closing date and time.

15. REJECTING A PROPOSAL: At any time during this RFP, the State may reject a proposal if the State determines that: (a) the person submitting the proposal is not responsible; or (b) the proposal is not responsive or does not meet the mandatory minimum requirements stated in this RFP.

16. TECHNOLOGY MODIFICATIONS: The awarded contract(s) may be modified as a result from technological upgrades for the procurement item(s). Any modification for upgraded technology must be substantially within the scope of the original procurement or contract, and if both parties agree to the modification, then the contract may be modified, but not extended beyond the term of the original awarded contract except as provided in the Utah Procurement Code. The awarded contract(s) may be modified for new technology related to the procurement item(s). Any modification for new technology shall not be exercised without: (1) the approval required under Section 63F-1-205 of the Utah Code, (2) the new technology modification has been subject to the review as described in Administrative Rule R33-6-114, and (3) the contracting parties agree to the modification.

17. PUBLICIZING AWARDS: The following shall be disclosed after receipt of a proper GRAMA request: (a) the contract(s) entered into as a result of the selection and the successful proposal(s), except for those portions that may not be disclosed under Rule R33-7-105; (b) the unsuccessful proposals, except for those portions that are Protected and the Offeror has submitted a proper Business Confidentiality Claim; (c) the rankings of the proposals; (d) the names of the members of any selection committee (reviewing authority); (e) the final scores used by the selection committee to make the selection, except that the names of the individual scorers shall not be associated with their individual scores or rankings; and (f) the written justification statement supporting the selection, except for those portions that may not be disclosed under Rule R33-7-105.

After due consideration and public input, the following has been determined by the Procurement Policy Board to impair governmental procurement proceedings or give an unfair advantage to any person proposing to enter into a contract or agreement with a governmental entity, and will not be disclosed by the governmental entity at any time to the public, including under any GRAMA request:
(a) the names of individual scorers/evaluators in relation to their individual scores or rankings; (b) any individual scorer's/evaluator's notes, drafts, and working documents; (c) non-public financial statements; and (d) past performance and reference information which is not provided by the offeror and which is obtained as a result of the efforts of the governmental entity. To the extent such past performance or reference information is included in the written justification statement, it is subject to public disclosure.

18. PERFORMANCE AND COST ANALYSIS: The State reserves the right to review the awarded contract(s) on a regular basis regarding performance and cost, and may negotiate price and service elements during the term of the contract.

19. AWARDED CONTRACT(S): Contract(s) awarded from this RFP will include the following documents: the scope of work, the appropriate State of Utah Standard Terms and Conditions, and any other documents listed in this RFP. (Revision Date: 1 July 2015)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 11
#2..
- 55 -
1 The State of Utah
Division of Purchasing
In conjunction with
Request for Proposals
Utah Solicitation Number CH16012

NASPO ValuePoint Master Agreement for
Cloud Solutions
December 21, 2015
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 12
#2..
- 56 -
2 1 RFP Administrative Information
RFP Title: Cloud Solutions
RFP Project Description: The State of Utah, in conjunction with NASPO ValuePoint, is seeking Contract Vendor(s) to
provide cloud solutions as described in the RFP.

RFP Lead: Christopher Hughes, Assistant Director
State of Utah, Division of Purchasing
[email protected]
(801) 538-3254
Submit sealed proposal (if submitting manually):

MANUAL PROPOSALS MUST BE RECEIVED AT THE

PHYSICAL ADDRESS DESIGNATED FOR COURIER

SERVICE AND TIME/DATE STAMPED BY THE UTAH

DIVISION OF PURCHASING PRIOR TO THE
CLOSING DATE AND TIME. PROPOSALS RECEIVED

AFTER THE DEADLINE, REGARDLESS OF REASON,
WILL NOT BE REVIEWED.

Submit electronically via Bidsync:

Address for Courier:

State of Utah Division of Purchasing
3150 State Office Building, Capitol Hill
Salt Lake City, Utah 84114-1061.

Electronic Submission:
www.bidsync.com
Question and Answer Period: December 21, 2015 – January 29, 2016 RFP Closing Date: March 10, 2016 at 1:00 pm MTN
Initial Term of Master Agreement and Renewals: The term of the Master Agreement will be ten (10) years with no renewal periods. Upon
mutual agreement, the Master Agreement may
be extended or amended.

TAKE NOTE OF THE 0.25% NASPO VALUEPOINT ADMINISTRATIVE FEE WHICH MUST BE INCORPORATED INTO YOUR BASE PRICE. OTHER STATES, INCLUDING THE STATE OF UTAH, MAY

NEGOTIATE ADDITIONAL ADMINISTRATIVE FEES IN THEIR PARTICIPATING ADDENDA FOLLOWING AWARD OF A MASTER AGREEMENT.

The Request for Proposal contains the following Attachments and Exhibits:

Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions Exhibit 1 to Attachment A: Software-as-a-Service Terms and Conditions Exhibit 2 to Attachment A: Platform-as-a-Service Terms and Conditions Exhibit 3 to Attachment A: Infrastructure-as-a-Service Terms and Conditions Attachment B: Explanation Cloud Security Alliance Questionnaires Exhibit 1 to Attachment B: Consensus Assessments Initiative Questionnaire Exhibit 2 to Attachment B: Cloud Controls Matrix
Attachment C: NIST Service Models
Attachment D: Scope of Services
Attachment E: Intent to Participate & State-specific terms and conditions Attachment F: Intentionally Removed
Attachment G: Cost Proposal Form
Attachment H: Identification of Service Models
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 13
#2..
- 57 -
3 This Request for Proposals (“RFP”), having been determined to be the appropriate procurement method to provide the best value to the State of Utah Division of Purchasing, is designed to provide interested Offerors with sufficient basic information to submit proposals. It is not intended to limit a proposal's content or exclude any relevant or essential data or information. Offerors are at liberty and are encouraged to expand upon the specifications to evidence capability to provide the cloud solutions requested in the RFP. The RFP is issued in accordance with State of Utah Procurement Code, Utah Code Annotated (UCA) Chapter 63G-6a, and applicable Rules found in the Utah Administrative Code (UAC). If any provision of this RFP conflicts with the UCA or UAC, the UCA or UAC will take precedence 2 GENERAL INFORMATION
This RFP is designed to provide interested Offerors with sufficient information to submit proposals meeting minimum requirements and technical qualifications.

2.1 PURPOSE
The State of Utah, Division of Purchasing (Lead State) is requesting proposals for cloud solutions in furtherance of the NASPO ValuePoint Cooperative Purchasing Program. The purpose of this Request for Proposals (RFP) is to establish Master Agreements with qualified Offerors to provide services related to cloud solutions for all Participating Entities. The objective of this RFP is to obtain best value, and achieve more favorable pricing, than is obtainable by an individual state or local government entity because of the collective volume of potential purchases by numerous state and local government entities. The Master Agreement(s) resulting from this procurement shall be extended to state governments (including departments, agencies, institutions), institutions of higher education, political subdivisions (i.e., colleges, school districts, counties, cities, etc.), the District of Columbia, territories of the United States, and other eligible entities subject to approval of the individual state procurement director and compliance with local statutory and regulatory provisions. The initial term of the Master Agreement shall be ten (10) years with no renewal provisions; however, Contract Vendors must submit an annual certification that they are still compliant with the mandatory minimum requirements and technical specification of the RFP.

The resulting Master Agreement contract(s) will provide Participating Entities with access to technical capabilities that run in cloud environments and meet the NIST Essential Characteristics.

Sub-categories in scope are the three NIST Service Models, Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS).

The awarded contracts will allow Participating Entities to choose cloud solutions that meet the following descriptions:

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 14
#2..
- 58 -
4  Commercially available cloud computing services
 Meets the National Institute for Standards and Technology (NIST) definition of Cloud Computing
 Open to all deployment models (private, public, community or hybrid), vendors specify deployment models

2.2 LEAD STATE
The State of Utah Division of Purchasing is the Lead State and issuing office for this solicitation and all subsequent addenda relating to it. The reference number for the transaction is CH16012.

This number must be referred to on all proposals, correspondence, and documentation relating to the RFP.

2.3 DEFINITIONS
The following definitions apply to the RFP. Attachment A contains the definitions of terms used in the NASPO ValuePoint Master Agreement Terms and Conditions. Attachment D, the Scope of Services, contains the definitions for the Service Models, Deployment Models and the NIST Essential Characteristics.

Contract Vendor means the Offeror awarded a Master Agreement by the Lead State. The Contract Vendor is the party responsible for delivering the Offerings under the terms and conditions set forth in the Master Agreement.

Eligible Users means every agency, political subdivision, or nonprofit that has the statutory authority to purchase from state cooperative contracts established by a Participating Entity to qualify for the cloud solutions described in the RFP. The Participating Entity will have sole discretion to determine who qualifies as an Eligible User.

Fulfillment Partner means a third-party contractor qualified and authorized by Contractor, and approved by the Participating State under a Participating Addendum, who may, to the extent authorized by Contractor, fulfill any of the requirements of this Master Agreement including but not limited to providing Solutions under this Master Agreement and billing Customers directly for such Solutions. Contractor may, upon written notice to the Participating State, add or delete authorized Fulfillment Partners as necessary at any time during the contract term. Fulfillment Partner has no authority to amend this Master Agreement or to bind Contractor to any additional terms and conditions.

Lead State means the State conducting this cooperative procurement, evaluation, and award.

Master Agreement means the underlying agreement executed by and between the Lead State, acting on behalf of NASPO ValuePoint, and the Contract Vendor, as now or hereafter amended.

Offeror means the company or firm which submits a proposal in response to this Request for Proposal.

Participating Addendum means a written statement of agreement signed by the Contract Vendor and a Participating State or Participating Entity that clarifies the operation of the Master Agreement for the Participating Entity (e.g. ordering procedures specific to Participating State) and may add other state-specific language or other requirements. A Participating Addendum State of Utah Bid CH16012
3/22/2016 4:23 PM p. 15
#2..
- 59 -
5 evidences the Participating Entity’s willingness to purchase and the Contract Vendor’s willingness to provide Offerings under the terms and conditions of the Master Agreement with any and all exceptions noted and agreed upon.

Participating State or Participating Entity means States that utilize the Master Agreement established by the RFP and enter into a Participating Addendum which further defines their participation.

Proposal means the official written response submitted by an Offeror in response to this Request for Proposal.

Purchasing Entity means any end-user in a Participating State (or other Participating Entity) that is eligible to use the Master Agreement(s) through the Participating Addendum.

Request for Proposals or RFP means the entire solicitation document, including all parts, sections, exhibits, attachments, and amendments.

Solutions or Offerings means deployment models (e.g. private, public, community, or hybrid) or the service model of cloud computing (e.g. IaaS, PaaS, SaaS, or a combination thereof), that most closely describes the Offeror’s offering for the RFP.

Subcontractor means any organization, whether designated as a subcontractor, fulfillment partner, reseller, etc., that will assist an Offeror to provide an Offering if awarded a Master Agreement.

2.4 NASPO VALUEPOINT BACKGROUND INFORMATION
NASPO ValuePoint Cooperative Purchasing Program, facilitated by the NASPO Cooperative Purchasing Organization LLC, a 501(c)(3) limited liability company (doing business as NASPO ValuePoint) is a subsidiary organization the National Association of State Procurement Officials (NASPO), the sole member of NASPO ValuePoint. The NASPO ValuePoint Cooperative Purchasing Organization facilitates administration of the cooperative group contracting consortium of state chief procurement officials for the benefit of state departments, institutions, agencies, and political subdivisions and other eligible entities (i.e., colleges, school districts, counties, cities, some nonprofit organizations, etc.) for all states and the District of Columbia. The NASPO ValuePoint Cooperative Development Team is identified in the Master Agreement as the recipient of reports and may be performing contract administration functions as assigned by the Lead State.

2.5 PARTICIPATING STATES
In addition to the Lead State conducting this solicitation, the following Participating States have requested to be named in the RFP as potential participating entities on the resulting Master Agreement: See Attachment E. Other entities may become Participating Entities after award of the Master Agreement. State-specific terms and conditions that will govern each state’s Participating Addendum are included in Attachment E, and/or may be incorporated into the Participating Addendum after award.

Additional States may be added with the consent of the awarded Contract Vendor and the Lead State (on behalf of NASPO ValuePoint) through execution of a Participating Addendum.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 16
#2..
- 60 -
6 2.6 ANTICIPATED USAGE
This is a new service for the Lead State and NASPO ValuePoint. Therefore, annual usage data is not available. Usage will be dependent on the needs of each Participating Entity. No minimum or maximum level of sales volume is guaranteed or implied in awarded Master Agreements awarded under the RFP.

2.7 TERMS AND CONDITIONS GOVERNING SOLICITATION AND RESULTING AGREEMENTS

2.7.1 Solicitation
The solicitation consists of the RFP document, including all Exhibits and Attachments listed on Bidsync.

2.7.2 Master Agreement
The Master Agreement(s) awarded from this RFP will consist of the negotiated Master Agreement Terms and Conditions, the relevant Scope of Services, the Offeror’s Cost Proposal form, and the winning Offeror’s Proposal as revised (if permitted) and accepted by the Lead State.

2.7.3 Participating Addenda
Participating Entities, including the State of Utah, may negotiate additional and/or different terms and conditions in a Participating Addendum, which will take precedence over the terms of the Master Agreement in the event of conflict. Participating Entities may not negotiate the addition of services not contemplated by this RFP.

2.8 Contract Award
It is anticipated that the RFP will result in multiple contract awards established by the multiple award methodology.

The multiple award methodology: All offerors that meet/exceed the technical minimum scoring thresholds and all solicitation minimum requirements will be eligible for award - subject to successful terms and conditions negotiations. Participating Entities and Eligible Users may base their “best value” selection of the offeror whose qualifications best meet their needs after reviewing qualifications outlined in the offeror’s proposal and considering other information in the solicitation process relevant to their determination of best value (such as the proposals and evaluations).

The awarded Master Agreement(s) may be modified as a result of technological upgrades for the procurement item(s). Any modification for upgraded technology must be substantially within the scope of the original procurement or contract, and if both parties agree to the modification, then the contract may be modified, but it may not extended beyond the term of the original awarded contract unless otherwise permitted by law. The awarded contract(s) may be modified for new technology related to the procurement item(s).

Open-Ended Procurement: Pursuant to Part 4 and 7 of the Utah Procurement Code, it is the intent of the RFP to be for ten years with recertification of the Contract Vendors on an annual basis, as required by Section 5.8. A Contract Vendor’s failure to recertify will result in the termination of its Master Agreement.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 17
#2..
- 61 -
7 In addition, on a biennial basis the Lead State may re-issue a solicitation, using this RFP document, to solicit new vendors that can provide additional Cloud Solutions to Participating Entities and Purchasing Entities.

2.9 Scope of Services
The Scope of Services is provided in Attachment D. To meet the requirements of many of the Participating Entities the Scope of Services was modeled after NIST, including any definitions, security controls, and mechanisms for implementation. Participating Entities may have to modify definitions and terms in order to comply with federal, state, and local laws, regulations, and guidelines. Proposals should demonstrate their compliance with the standards set forth in Attachment D.

2.10 Choice of Law, Solicitation Jurisdiction, and Venue The provisions of the RFP and all matters, including any dispute or protest, in regard to the RFP that occur prior to the full execution of any contract resulting from the RFP, shall be governed by the laws of the State of Utah. The parties will submit to the jurisdiction of the courts of the State of Utah for any dispute arising out of the RFP or any matter related thereto prior to the full execution of the awarded contract(s). Venue for said dispute or protest shall be in Salt Lake City, in the Third Judicial District Court for Salt Lake County. The provisions of the Utah Procurement Code, Title 63G, Chapter 6a, and Utah Administrative Code Rules R33 must be met in regard to any protest. The substantially successful party, including any intervening parties, shall be entitled to their reasonable attorney fees and costs being paid by the substantially unsuccessful party(ies). This paragraph shall not supersede any provision related to a purchasing entity outside the State of Utah.

2.11 Other Value-Added Services
Offerors may propose other Value-Added Services in their response. Such services from an awarded Offeror, if consistent with this Scope of Services, recommended by the Evaluation Team, and accepted by the Lead State, would be added to the final awarded contract.

2.12 Service Line Additions and Updates
During the term of the Master Agreement(s), Offerors may submit a request to update the awarded Solutions as services are introduced or removed from the Offeror’s offerings. The Master Agreement Administrator will evaluate requests and update the contract offering via written amendment as appropriate. The Offerors shall update the dedicated website, price lists, and catalogs to reflect approved changes. Pricing must utilize the same pricing structure as was used for services falling into the same service category.

2.13 Additional Sources
In the best interest of the states involved, NASPO ValuePoint, Participating States, and Purchasing Entities reserve the right to competitively solicit additional sources for these commodities during the contract term. Further, Participating States may have existing awards for commodities with the scope of the RFP.

2.14 NASPO ValuePoint eMarket Center
The awarded cloud service contractors will not have any type of catalog within the eMarket Center, they will have Ordering Instructions. These instructions provide visibility to the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 18
#2..
- 62 -
8 contractor within the eMarket Center as well as provide information about the contractor and how to order directly from the contractor, outside of the eMarket Center.

In July 2011, NASPO ValuePoint entered into a multi-year agreement with SciQuest, Inc. whereby SciQuest will provide certain electronic catalog hosting and management services to enable eligible NASPO ValuePoint’s customers to access a central online website to view and/or shop the goods and services available from existing NASPO ValuePoint Cooperative Contracts.

The central online website is referred to as the NASPO ValuePoint eMarket Center.

The Contractor will have visibility in the eMarket Center through Ordering Instructions. These Ordering Instructions are available at no cost to the Contractor and provided customers information regarding the Contractors website and ordering information.

At a minimum, the Contractor agrees to the following timeline: NASPO ValuePoint eMarket Center Site Admin shall provide a written request to the Contractor to begin Ordering Instruction process. The Contractor shall have thirty (30) days from receipt of written request to work with NASPO ValuePoint to provide any unique information and ordering instructions that the Contractor would like the customer to have.
3 SOLICITATION REQUIREMENTS, INFORMATION AND INSTRUCTIONS

3.1 QUESTION AND ANSWER PERIOD
The RFP is issued by the State of Utah Division of Purchasing via Bidsync. The Division of Purchasing is the only contact for this solicitation. Do not contact any other Participating Entity about the RFP.

All questions MUST be submitted through BIDSYNC (www.bidsync.com) during the designated time for questions (“Q&A period”) listed on Bidsync. Questions submitted through any other channel will not be answered. Questions may be answered in the order that they are submitted or may be compiled into one document and answered via an addendum. Answers disseminated by the State through the BidSync system shall serve as the official and binding position of the State and will constitute an addendum to this RFP.

Questions, exceptions, or notification to the State of any ambiguity, inconsistency, excessively restrictive requirement, or error in this RFP, MUST be submitted as a question through BidSync during the Q&A period.

Questions may be answered individually or may be compiled into one document. Questions may also be answered via addenda. An answered question or addenda may modify the specification or requirements of this RFP. Answered questions and addendums will be posted on BidSync.

Offerors should periodically check BidSync for answered questions and addendums before the closing date. It is the responsibility of the Offerors to submit their proposal as required by this RFP, including any requirements contained in an answered question and/or addendums.

Exceptions to scope/content of the RFP within an Offeror’s proposal that have not been previously addressed within the Q&A period of the procurement are not allowed and may result in the Offeror’s proposal being considered non-responsive.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 19
#2..
- 63 -
9 3.2 ADDENDUMS
Offerors are encouraged to periodically check BidSync for posted questions, answers and addendums. Offerors will not be notified by the Lead State or Bidsync for each addendum issued under the RFP.

Any modification to this procurement will be made by addendum issued by the Lead State.

Addendums to the RFP may be made for the purpose of making changes to: the scope of work, the schedule, the qualification requirements, the criteria, the weighting, or other requirements of the RFP.

After the due date and time for submitting a proposal to the RFP, at the discretion of the Lead State, addenda to the RFP may be limited to the Offerors that have submitted proposals, provided the addenda does not make a substantial change to the RFP that likely would have impacted the number of Offerors responding to the original publication of the RFP, in the opinion of the Lead State.

Authorized and properly issued addenda shall constitute the official and binding position of the State.

Any response to the RFP which has as its basis any communications or information received from sources other than the RFP or related addenda may be considered non-responsive and be rejected at the sole discretion of the State.

3.3 RESTRICTIONS ON COMMUNICATIONS
From the issue date of the RFP until the contract award(s), Offerors are prohibited from communications regarding the RFP with other Participating Entities EXCEPT the Lead State.

Failure to comply with this requirement may result in disqualification.

3.4 Exceptions to RFP and NASPO ValuePoint Master Agreement Terms and Conditions Any contract resulting from this RFP will include the NASPO ValuePoint Master Agreement Terms and Conditions (Master Agreement Terms and Conditions), Attachment A, including Exhibits to Attachment A.

Exceptions and/or additions to the Master Agreement Terms and Conditions and other requirements of this RFP are strongly discouraged. Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offeror’s proposal. The Lead State will not consider proposed modifications and/or additions to the Master Agreement Terms and Conditions after the deadline for proposals. Exceptions and/or additions regarding the Master Agreement Terms and Conditions or other RFP provisions must contain the following:

1. The rationale for the specific requirement being unacceptable to the Offeror submitting the exception and/or addition;

2. Recommended verbiage for the Lead State’s consideration that is consistent in content, context, and form with the Master Agreement Terms and Conditions;

3. Explanation of how the Lead State’s acceptance of the recommended verbiage is fair and equitable to both the Lead State, the Participating Entities, and to the Offeror submitting the modification and/or exception.

Offerors may not submit requests for exceptions and/or additions by reference to an Offeror's State of Utah Bid CH16012
3/22/2016 4:23 PM p. 20
#2..
- 64 -
10 website or URL. URLs provided with a proposal may result in that proposal being rejected as nonresponsive. Offerors may submit questions during the Q&A period regarding the Master Agreement Terms and Conditions.

The Lead State may refuse to negotiate exceptions and/or additions that are determined to be excessive; that are inconsistent with similar contracts; and to warranties, insurance, or indemnification provisions that are necessary to protect the procurement unit after consultation with the Attorney General's Office or other applicable legal counsel, including a Participating Entity.

For the RFP, the Lead State reserves the right to negotiate exceptions and/or additions to terms and conditions in a manner resulting in expeditious resolutions. This process may include beginning negotiations with the qualified Offeror having the least amount of exceptions and/or additions and concluding with the Offeror submitting the greatest number of exceptions and/or additions. Contracts may be executed and become effective as negotiations are completed; however, all of the resulting Master Agreement(s) will terminate on the same date.

If negotiations are required, Offeror must provide all documents in Microsoft Word format for redline editing. Offeror must also provide the name, contact information, and access to the person(s) that will be directly involved in legal negotiations.

An award resulting from the RFP is subject to successful contract terms and conditions negotiation (if required). The Lead State, at its sole discretion, will determine when contract terms and conditions negotiations become unproductive and will result in termination of award to that Offeror.

3.5 PROPOSAL DUE DATE
Proposals must be received by the closing date and time as described on Bidsync. Proposals received after the deadline will not be accepted.

3.6 CANCELLATION OF PROCUREMENT
The RFP may be canceled at any time prior to award of the Master Agreement(s), if the Lead State determines such action to be in the collective best interests of potential Participating States.

3.7 GOVERNING LAWS AND REGULATIONS
The RFP is conducted by the Lead State, in accordance with its procurement code and applicable administrative rules, which can be found in Utah Code, Utah Administrative Code, and other policies, available at: http://purchasing.utah.gov/.

This procurement shall be governed by the laws and regulations of the Lead State. Venue for any administrative or judicial action relating to the RFP, evaluation, and award shall be in Salt Lake County, Utah. The provisions governing choice of law and venue for issues arising after award and during contract performance are specified in Attachment A.

3.8 Intentionally Deleted.

3.9 RIGHT TO ACCEPT ALL OR PORTION OF PROPOSAL
Unless otherwise specified in the solicitation, the Lead State may accept any Offering or State of Utah Bid CH16012
3/22/2016 4:23 PM p. 21
#2..
- 65 -
11 combination of Offerings as specified in the solicitation or of any proposal.

3.10 PROPOSAL CONTENT AND FORMAT REQUIREMENTS
Include a Table of Contents in the Proposal identifying the contents of each section, including page numbers of major sections. Proposals should follow the numerical order of the RFP starting at the beginning and continuing through the end of the RFP. Proposal sections and subsections shall be identified with the corresponding numbers and headings used in the RFP. In your response, restate the RFP section and/or subsection, followed with your response. Offerors are encouraged to use a different color font, bold text, italics, or other indicator to clearly distinguish the RFP section or subsection from the Offeror’s response.

Proposals must be detailed and concise. The format is designed to ensure a complete submission of information necessary for an equitable analysis and evaluation of submitted proposals. There is no intent to limit the content of proposals; however, technical responses must focus on responding to the RFP and should not include preprinted advertising materials.

3.11 PROPOSAL SUBMISSION INSTRUCTIONS
Proposals may be submitted manually or electronically. Proposals must be submitted as described in Section 3.10.

3.11.1 Electronically Submitted Proposals
Electronically submitted proposals must be submitted through Bidsync, the Lead State’s eProcurement provider, at www.bidsync.com. When submitting through Bidsync, enter your “Total Cost” in Bidsync as “$0,” and UPLOAD YOUR SEPARATE TECHNICAL PROPOSAL, COST PROPOSAL AND ALL OTHER REQUIRED DOCUMENTS, including your signed State of Utah Signature Page.

Electronic proposals may require uploading of electronic attachments. BidSync will accept a wide variety of document types as attachments. However, the State is unable to view certain attachments. Therefore, DO NOT submit attachments that are embedded (zip files), movies, wmp, encrypted, or mp3 files. All attachments must be uploaded in BidSync as separate files. All attachments shall be submitted in a format acceptable to the Lead State. Acceptable formats include .doc (Microsoft Word document), .xls (Microsoft Excel spreadsheet), and .pdf (Adobe Acrobat portable document format).

Be advised that the “Offeror” for bid evaluation and award purposes is the entity profile you submit under in Bidsync, which must be the same legal entity presented in your attached response materials. Your submission via Bidsync is your electronic signature, acknowledging the statements contained in the State of Utah Signature Page.

Offerors are further advised to upload response materials with descriptive file names, organized and consolidated in a manner which allows evaluators to efficiently navigate their response; as the Lead State will print uploaded documents for evaluation in the manner received via Bidsync.

3.11.2 Manually Submitted Proposals
Manually submitted proposals must be addressed to the RFP Lead and must be sealed and identified as “CH16012 – Cloud Solutions.” The Technical Proposal and separately State of Utah Bid CH16012
3/22/2016 4:23 PM p. 22
#2..
- 66 -
12 sealed Cost Proposal must be submitted at the same time (place all proposal response materials within a larger package).

The Technical portion of the Proposal must be clearly marked “TECHNICAL PROPOSAL – CH16012 - Cloud solutions.”
Each proposal must be submitted in one (1) original with eight (8) copies of the Technical Proposal and one (1) original and one (1) copy of the Cost Proposal.

Offerors submitting manually must also submit one (1) electronic copy of the proposal on CD or USB device. Word or Excel format is required (the only exception is for financials, brochures or other information only available in an alternate format). The format and content must be the same as the manually submitted proposal. The electronic version must NOT be password protected or locked in any way.

Offeror should allow sufficient time for delivery of hardcopy proposals. Proposals sent overnight, but not received by the deadline time will not be accepted. When submitting a proposal by physical delivery (U.S. Mail, courier service, hand-delivery, or other physical means), Offerors are solely responsible for meeting the deadline. Delays caused by a delivery service or other physical means will not be considered as an acceptable reason for a proposal being late. All proposals received by physical delivery will be date and time stamped by the Lead State.

If your proposal, whether electronically or manually submitted, contains proprietary or confidential information which you have identified, you must also submit a redacted copy of the Technical Proposal (in electronic format, with the word “redacted” in the file name) with all proprietary or confidential information removed or blacked out; as well as a separate document containing a complete list (per the instructions in Subsection 3.11, below) of all trade secret information which was removed or blacked out in the redacted copy.

3.11.3 Cost proposal will be evaluated independently from the technical proposal, pursuant to Utah Code Annotated (UCA) § 63G-6-707(5), and as such, must be submitted separate from the technical proposal. Failure to submit cost or pricing data separately may result in your proposal being judged as non-responsive and ineligible for contract award. The Cost Proposal must be separately sealed and identified as “Cost Proposal –CH16012 Cloud solutions.”

3.12 SUBMISSION OF PROPOSAL
By submitting a proposal to the RFP, the Offeror acknowledges and agrees that the requirements, scope of work, and the evaluation process outlined in the RFP are understood, fair, equitable, and are not unduly restrictive. Any exceptions to the content of the RFP, excluding the Master Agreement Terms and Conditions contained in Attachment A, including the Exhibits to Attachment A, must be addressed within the Q&A period. The Offeror further acknowledges that it has read the RFP, along with the Exhibits, Attachments, and any attached or referenced documents, including the General Provisions.

All Proposals must be submitted in the following format. Offerors should title each document with the names listed below. Proposals may be submitted as one document with a separately attached State of Utah Bid CH16012
3/22/2016 4:23 PM p. 23
#2..
- 67 -
13 Cost Proposal form or as individual documents. If an Offeror submits a redacted version of a document it should clearly label the document as redacted. Detailed information on submitting each of these sections is contained later sections of this RFP.

1. Section Title: RFP Signature Page. The Lead State’s Request for Proposal Signature Page completed and signed. See Section 5.1 of the RFP.

2. Section Title: Executive Summary. The one or two page executive summary is to briefly describe the Offeror's Proposal. This summary should highlight the major features of the Proposal. It must indicate any requirements that cannot be met by the Offeror. The Lead State should be able to determine the essence of the Proposal by reading the executive summary. See Section 5.4 of the RFP.

3. Section Title: Mandatory Minimums: This section should constitute the Offeror’s point-bypoint response to each item described in Section 5 of the RFP, except 5.1 (Signature Page) and

5.4 (Executive Summary). An Offeror’s response must be a specific point-by-point response, in the order listed, to each requirement in the Section 5 of the RFP.

4. Section Title: Business Profile: This section should constitute the Offeror’s response to the items described in Section 6 of the RFP. An Offeror’s response must be a specific point-bypoint response, in the order listed, to each requirement in the Section 6 of the RFP.

5. Section Title: Organization Profile: This section should constitute the Offeror’s response to the items described in Section 7 of the RFP. An Offeror’s response must be a specific pointby-point response, in the order listed, to each requirement in the Section 7 of the RFP.

6. Section Title: Technical Response. This section should constitute the Technical response of the proposal and must contain at least the following information:

A. A complete narrative of the Offeror's assessment of the Cloud Solutions to be provided, the Offerors ability and approach, and the resources necessary to fulfill the requirements. This should demonstrate the Offeror's understanding of the desired overall performance expectations and clearly indicate any options or alternatives proposed.

B. A specific point-by-point response, in the order listed, to each requirement in the Section 8 of the RFP. Offerors should not provide links to a website as part of its response.

Offeror’s should focus their proposals on the technical qualifications and capabilities described in the RFP. Offerors should not include sales brochures as part of their response.

7. Section Title: Confidential, Protected or Proprietary Information. All confidential, protected or proprietary Information must be included in this section of proposal response. Do not incorporate protected information throughout the Proposal. Rather, provide a reference in the proposal response directing Lead State to the specific area of this protected Information section.

If there is no protected information, write “None” in this section.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 24
#2..
- 68 -
14 Failure to comply with this Section and Section 3.13 of the RFP releases the Lead State, NASPO ValuePoint, and Participating Entities from any obligation or liability arising from the inadvertent release of Offeror information.

8. Section Title: Exceptions and/or Additions to the Standard Terms and Conditions. Proposed exceptions and/or additions to the Master Agreement Terms and Conditions, including the exhibits, must be submitted in this section. Offeror must provide all proposed exceptions and/or additions, including an Offeror’s terms and conditions, license agreements, or service level agreements in Microsoft Word format for redline editing. Offeror must also provide the name, contact information, and access to the person(s) that will be directly involved in terms and conditions negotiations.

If there are no exceptions or additions to the Master Agreement Terms and Conditions, write “None” in this section.

9. Section Title: Cost Proposal. Cost Proposals will be evaluated independently from the technical proposal. Offeror’s cost proposal must include the items discussed in Section 9 of the RFP.

Cost will be evaluated independently from the Mandatory Minimum Requirements, and the Technical responses. Inclusion of any cost or pricing data within the Detailed Technical Proposal will result in the proposal being judged as non-responsive for violation of UCA § 63G-6a-707(5).

All costs incurred by an Offeror in the preparation and submission of a proposal, including any costs incurred during interviews, oral presentations, and/or product demonstrations are the responsibility of the Offeror and will not be reimbursed by the Lead State or NASPO ValuePoint.

3.13 CONFIDENTIAL OR PROPRIETARY INFORMATION
The Government Records Access and Management Act (GRAMA), UCA § 63G-2-305, provides in part that:
the following records are protected if properly classified by a government entity:
(1) trade secrets as defined in Section 13-24-2, the Utah Uniform Trade Secrets Act, if the person submitting the trade secret has provided the governmental entity with the information specified in UCA § 63G-2-309 (Business Confidentiality Claims);
(2) commercial information or non-individual financial information obtained from a person if:
(a) disclosure of the information could reasonably be expected to result in unfair competitive injury to the person submitting the information or would impair the ability of the governmental entity to obtain necessary information in the future; (b) the person submitting the information has a greater interest in prohibiting access than the public in obtaining access; and
(c) the person submitting the information has provided the governmental entity with the information specified in UCA § 63G-2-309;
* * * * *
(6) records, the disclosure of which would impair governmental procurement proceedings or give an unfair advantage to any person proposing to enter into a contract or agreement with a governmental entity, except, subject to Subsections (1) and (2), that this Subsection (6) does not restrict the right of a person to have access to, after the contract or grant has been State of Utah Bid CH16012
3/22/2016 4:23 PM p. 25
#2..
- 69 -
15 awarded and signed by all parties, ...

Pricing may not be classified as confidential or protected and will be considered public information after award of the contract.

Process for Requesting Non-Disclosure: Any Offeror requesting that a record be protected shall include with the proposal a Claim of Business Confidentiality. To protect information under a Claim of Business Confidentiality, the Offeror must complete the Claim of Business Confidentiality form with the following information:

1. Provide a written Claim of Business Confidentiality at the time the information (proposal) is provided to the state, and

2. Include a concise statement of reasons supporting the claim of business confidentiality (UCA § 63G-2-309(1)).

3. Submit an electronic “redacted” (excluding protected information) copy of the record.

The redacted copy must clearly be marked “Redacted Version.” The Claim of Business Confidentiality Form may be accessed at:
http://www.purchasing.utah.gov/contract/documents/confidentialityclaimform.doc An entire proposal cannot be identified as “PROTECTED”, “CONFIDENTIAL” or “PROPRIETARY”, and if so identified, shall be considered non-responsive unless the Offeror removes the designation.

Redacted Copy: If an Offeror submits a proposal that contains information claimed to be business confidential or protected information, the Offeror must submit two separate proposals: one redacted version for public release, with all protected business confidential information either blacked-out or removed, clearly marked as "Redacted Version"; and one nonredacted version for evaluation purposes, clearly marked as "Protected Business Confidential." The Lead State and NASPO ValuePoint are not liable or responsible for the disclosure of any confidential or proprietary information if the Offeror fails to follow the instructions of this section.

3.14 ERRORS IN PROPOSALS
Pursuant to UAC R33-7-403, the following shall apply to the correction or withdrawal of an unintentionally erroneous proposal, or the cancellation of an award or contract that is based on an unintentionally erroneous proposal. A decision to permit the correction or withdrawal of a proposal or the cancellation of an award or a contract shall be supported in a written document, signed by the chief procurement officer or head of a procurement unit with independent procurement authority.
(1) Mistakes attributed to an offeror's error in judgment may not be corrected. (2) Unintentional errors not attributed to an offeror's error in judgment may be corrected if it is in the best interest of the procurement unit and correcting the error maintains the fair treatment of other offerors.
(a) Examples include:
(i) missing signatures;
(ii) missing acknowledgement of an addendum;
(iii) missing copies of professional licenses, bonds, or insurance certificates, provided that copies are submitted by the deadline State of Utah Bid CH16012
3/22/2016 4:23 PM p. 26
#2..
- 70 -
16 established by the chief procurement officer or head of a procurement unit with independent procurement authority to correct this mistake; (iv) typographical errors;
(v) mathematical errors not affecting the total proposed price; or (vi) other errors deemed by the chief procurement officer or head of a procurement unit with independent procurement authority to be immaterial or inconsequential in nature.
(3) Unintentional errors discovered after the award of a contract may only be corrected if, after consultation with the chief procurement officer or head of a procurement unit with independent procurement authority and the attorney general's office or other applicable legal counsel, it is determined that the correction of the error does not violate the requirements of the Utah Procurement Code or applicable administrative rules.

3.15 E-RATE
To the extent the services offered are subject to the E-rate discount program, all award Contract Vendors must commit to participation in the Federal Communication Commission's E-rate discount program established under authority of the Federal Telecommunications Commission Act of 1996. Participation in, and implementation of, this program must be provided without the addition of any service or administration fee by the Contract Vendor.

In order to participate in E-Rate Offerors must appear on the USAC website as those who have a Service Provider Identification Number or “SPIN.”
4 EVALUATION AND AWARD

4.1 INITIAL REVIEW OF PROPOSALS

4.1.1 All proposals will be reviewed first to ensure that they meet the Mandatory Submission Requirements of the RFP as addressed in Sections noted with an (M). Any proposal(s) not meeting the Mandatory Submission Requirements may be found non-responsive.

4.1.2 The Technical Proposal will be evaluated first as either “pass” or “fail,” based on compliance with those requirements listed in the RFP with an (M), (ME), or (E). All proposals which are determined to be responsive will continue in the evaluation process outlined in this section.
(M) means that the requirement is mandatory and a proposal must contain a response to that requirement; however, the proposal response is not evaluated.

This is a pass/fail requirement as described in 4.3.1. The majority of these responses will require that the Offeror warrant or represent that it meets a certain requirement1
. Offerors are encouraged to demonstrate compliance with a mandatory minimum and to demonstrate that they meet or exceed to the requirement.
(ME) means that the requirement is both mandatory, as mentioned above will be reviewed in 4.3.1, and the proposal response will be evaluated and given a score under 4.3.2. If an Offeror’s proposal does not address the requirement then it will

1 The Lead State reserves the right to verify that an Offeror’s proposal meets the mandatory requirement.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 27
#2..
- 71 -
17 fail and therefore be disqualified.
(E) means that the proposal response will be evaluated as described in 4.3.2.

4.2 RIGHT TO WAIVE MINOR IRREGULARITIES
The State of Utah Chief Procurement Officer reserves the right to waive minor informalities as well as minor deviations. The Lead State also reserves the right to seek clarification on any proposal response.

4.3 EVALUATION PROCESS
In responding to this RFP, Offerors must identify and describe all of the Solutions that are contained in their proposals.

4.3.1 In the initial phase of the evaluation process, the Lead State will review all proposals timely received. Mandatory and scored on a pass/fail basis. A “Fail” will result in a proposal being deemed non-responsive and, therefore, will be disqualified. Failure to provide a response to each Mandatory requirement where indicated will result in disqualification.

Non-responsive proposals not conforming to the RFP requirements or unable to meet the mandatory minimum requirements will be eliminated from further consideration. The Offerors that meet the requirements and meet the mandatory minimum requirements will move on to the technical evaluation of their proposals.

Mandatory Minimum Requirements RFP Section Pass/Fail
Signature Page 5.1 Pass/Fail
Cover Letter 5.2 Pass/Fail
Acknowledgement of Amendments 5.3 Pass/Fail
Executive Summary 5.4 Pass/Fail
General Requirements 5.5 Pass/Fail
Re-Certification 5.7 Pass/Fail
Business Profile 6.1 Pass/Fail
Scope of Experience 6.2 Pass/Fail
Financials 6.3 Pass/Fail
Contract Manager 7.1 Pass/Fail
Cost Proposal Submitted 9.1 Pass/Fail

4.3.2 Evaluation of the Proposals will be evaluated and scored by an Evaluation Committee. It is anticipated that several Evaluation Committees will be established in order to evaluate all of the proposals in a reasonable amount of time. Proposals will be scored on the following evaluation criteria:

Evaluation Criteria RFP Section Points Possible
BUSINESS INFORMATION 6
Business Profile 6.1 25.0
Scope of Experience 6.2 25.0
General Information 6.4 25.0
Billing and Pricing Practices 6.5 25.0
Scope and Variety of Cloud Solutions 6.6 25.0
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 28
#2..
- 72 -
18 Best Practices 6.7 25.0
ORGANIZATION AND STAFFING 7
Contract Manager 7.1 25.0
TECHNICAL REQUIREMENTS 8
Technical Requirements 8.1 50.0
Subcontractors 8.2 50.0
Working with Purchasing Entities 8.3 50.0
Customer Service 8.4 50.0
Security of Information 8.5 50.0
Privacy and Security 8.6 50.0
Migration and Redeployment Plan 8.7 50.0
Service or Data Recovery 8.8 50.0
Data Protection 8.9 50.0
Service Level Agreements 8.10 50.0
Data Disposal 8.11 50.0
Performance Measures and Reporting 8.12 50.0
Cloud Security Alliance 8.13 50.0
Service Provisioning 8.14 50.0
Back up and Disaster Plan 8.15 50.0
Solution Administration 8.16 50.0
Hosting and Provisioning 8.17 50.0
Trial and Testing Periods 8.18 50.0
Integration and Customization 8.19 50.0
Marketing Plan 8.20. 50.0
Value-Added Services 8.21 50.0
Supporting Infrastructure 8.22 50.0
Alignment of Cloud Computing 8.23 50.0

Offerors must receive a minimum score of seventy percent (70%) of the total possible points in order to continue to the scoring the cost proposals. Offerors with a score of less than seventy percent (70%) of the total possible points will be deemed non-responsive and ineligible for further consideration. If an Offeror demonstrates that an evaluation criteria is not applicable to its Offering then those points will be deducted from that Offerors total possible points. For example if an Offeror demonstrates that the evaluation criteria for Privacy and Security in Section 8.6 of this RFP is not applicable to its proposal then 50 points will be removed from that Offeror’s total possible points (from 1325 to 1275). The Lead State reserves the right to determine whether an evaluation criteria applies to a proposal.

Offerors that achieve minimum score threshold of seventy percent (70%) of the total possible points, will proceed to the Cost Proposal Evaluation. The evaluation score sheet has been attached to this RFP. The attached evaluation score sheet states the relative weight that will be given to each evaluation criteria.

Each committee member shall independently read and score each proposal based on the technical non-price criteria set forth in the RFP to assess the completeness, quality, and desirability of each proposal. The Evaluation Committee will tally the final scores for criteria other than cost to arrive at a consensus score by the following method: an average State of Utah Bid CH16012
3/22/2016 4:23 PM p. 29
#2..
- 73 -
19 of the individual scores. Each proposal will be evaluated and scored by at least three evaluation committee members.

To clarify, an Offeror’s Cloud Solutions (SaaS, IaaS, or PaaS) are not being tested or demonstrated during the technical response; proposals are only being evaluated by the criteria described in the RFP. However, Purchasing Entities in making a “best value” determination may request a test or demonstration of an Offeror’s Solution. To help in the evaluation process Offerors should not include sales brochures as part of their proposals.

4.3.3 Cost Proposals will be opened only after Evaluation of Proposals has been completed.

Offerors that provide a price schedule with a minimum discount from its Cloud Solutions will receive 152.8 points. If an Offeror fails to provide a discount or a price schedule as required by Section 9.1 its proposal will be disqualified.

4.4 AWARD OF MASTER AGREEMENT(S)
Award shall be made to the responsive responsible Offeror(s) whose proposal(s) receive the minimum point thresholds and provides a Cost Proposal form as described in Section 4.3.3. The Lead State anticipates awarding multiple Master Agreements. The award of Master Agreement(s) will be made without regard to any preference for Utah suppliers. Participating Entities, including the State of Utah, may take local preferences into consideration when determining if they will enter into a Participating Addendum with a Contract Vendor to which a Master Agreement has been awarded.

4.5 NOTICE OF INTENT TO AWARD
After final selections are made, the Lead State will issue an intent-to-award announcement by letter to all responsive Offerors.

4.6 PROTEST PROCESSES
Offerors are directed to Utah Code Part 16 and Utah Administrative Code Rule R16 available at http://le.utah.gov/xcode/Title63G/Chapter6a/63G-6a-S1601.html and http://www.rules.utah.gov/publicat/code/r033/r033-016.htm for available protest processes.

4.7 PUBLICIZING AWARD(S)
The Lead State shall, on the next business day after the award of a contract(s) is announced, make available to each Offeror and to the public a written statement that includes:
(a) the name of the offeror to which the contract is awarded and the total score awarded by the evaluation committee to that offeror;
(b) the justification statement under UCA § 63G-6a-708, including any required cost-benefit analysis; and
(c) the total score awarded by the evaluation committee to each offeror to which the contract is not awarded, without identifying which offeror received which score.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 30
#2..
- 74 -
20 5 MANDATORY MINIMUM REQUIREMENTS
If applicable to an Offeror’s Solution, an Offeror must provide a point by point responses to each mandatory minimum requirement. If a mandatory minimum requirement is not applicable to an Offeror’s Solution then the Offeror must explain why the mandatory minimum requirement is not applicable.

If an Offeror’s proposal contains more than one Solution (i.e., SaaS and PaaS) then the Offeror must provide a response for each Solution. However, Offerors do not need to submit a proposal for each Solution.

5.1 (M) SIGNATURE PAGE
Proposals must be submitted with a vendor information form, located on Bidsync as an attachment to the RFP, which must contain an ORIGINAL HANDWRITTEN signature executed in INK OR AN ELECTRONIC SIGNATURE, and be returned with the Offeror’s proposal.

5.2 (M) COVER LETTER
Proposals must include a cover letter on official letterhead of the Offeror. The cover letter must identify the RFP Title and number, and must be signed by an individual authorized to commit the Offeror to the work proposed. In addition, the cover letter must include:

5.2.1 A statement indicating the Offeror’s understanding that they may be required to negotiate additional terms and conditions, including additional administrative fees, with Participating Entities when executing a Participating Addendum.

5.2.2 A statement naming the firms and/or staff responsible for writing the proposal.

5.2.3 A statement that Offeror is not currently suspended, debarred or otherwise excluded from federal or state procurement and non-procurement programs.

5.2.4 A statement acknowledging that a 0.25% NASPO ValuePoint Administrative Fee and any Participating Entity Administrative fee will apply to total sales for the Master Agreement(s) awarded from the RFP.

5.2.5 A statement identifying the service model(s) (SaaS, IaaS, and/or PaaS) and deployment model(s) that it is capable of providing under the terms of the RFP. See Attachment C for a determination of each service model subcategory. The services models, deployment models and risk categories can be found in the Scope of Services, Attachment D. Note:

Multiple service and/or deployment model selection is permitted, and at least one service model must be identified. See Attachment H.

5.2.6 A statement identifying the data risk categories that the Offeror is capable of storing and securing. See Attachment D and Attachment H.

5.3 (M) ACKNOWLEDGEMENT OF AMENDMENTS
If the RFP is amended, the Offeror must acknowledge each amendment with a signature on the acknowledgement form provided with each amendment. Failure to return a signed copy of each amendment acknowledgement form with the proposal may result in the proposal being found non-responsive.

5.4 (M) EXECUTIVE SUMMARY
Offerors must provide an Executive Summary of its proposal. An Executive Summary should highlight the major features of an Offeror’s proposal. Briefly describe the proposal in no more than three (3) pages. The evaluation committee should be able to determine the essence of the proposal by reading the Executive Summary. Any requirements that cannot be met by the Offeror must be included.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 31
#2..
- 75 -
21 5.5 (M) GENERAL REQUIREMENTS

5.5.1 Offeror must agree that if awarded a contract it will provide a Usage Report Administrator responsible for the quarterly sales reporting described the Master Agreement Terms and Conditions, and if applicable Participating Addendums.

5.5.2 Offeror must provide a statement that it agrees to cooperate with NASPO ValuePoint and SciQuest (and any authorized agent or successor entity to SciQuest) with uploading an Offeror’s ordering instructions, if awarded a contract.

5.5.3 Offeror must at a minimum complete, provide, and maintain a completed CSA STAR Registry Self-Assessment2. Offeror must either submit a completed The Consensus Assessments Initiative Questionnaire (CAIQ), Exhibit 1 to Attachment B, or submit a report documenting compliance with Cloud Controls Matrix (CCM), Exhibit 2 to Attachment B. Offeror must also represent and warrant the accuracy and currency of the information on the completed. Offerors are encouraged to complete and submit both exhibits to Attachment B.

5.5.4 Offeror, as part of its proposal, must provide a sample of its Service Level Agreement3, which should define the performance and other operating parameters within which the infrastructure must operate to meet IT System and Purchasing Entity’s requirements.

5.7 RECERTIFICATION OF MANDATORY MINIMUMS AND TECHNICAL SPECIFICATIONS Offeror must acknowledge that if it is awarded a contract under the RFP that it will annually certify to the Lead State that it still meets or exceeds the technical capabilities discussed in its proposal.

2 CSA STAR Self-Assessment documents the security controls provided by an Offeror’s offerings, thereby helping Purchasing Entities assess the security of an Offeror, if awarded a Master Agreement, they currently use or are considering using.
3 SLAs can vary depending on the cloud service being procured as well as the individual ordering activity, and the Lead State does not expect to require a single SLA to all cloud solutions being proposed under the RFP.

Additionally, by submitting a sample the Lead State does not agree to its terms and you understand that a Purchasing Entity may revise the SLA to conform to the requirements of its laws.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 32
#2..
- 76 -
22 6 BUSINESS INFORMATION

6.1 (M)(E) BUSINESS PROFILE
Provide a profile of your business including: year started, organizational structure, client base (including any focus by region, market sector, etc.), growth over the last three (3) years, number of employees, employee retention rates (specific for employees that may be associated with the services related to the RFP) over the last two (2) years, etc. Businesses must demonstrate a minimum of three (3) years of experience providing cloud solutions for large scale projects, including government experience, to be eligible for award.

6.2 (M)(E) SCOPE OF EXPERIENCE
Describe in detail the business’ experience with government or large consortium contracts similar to the Master Agreements sought through this RFP. Provide the approximate dollar value of the business’ five (5) largest contracts in the last two (2) years, under which the Offeror provided Solutions identical or very similar to those required by this RFP. Government experience is preferred.

6.3 (M) FINANCIALS
Offeror must provide audited financial statements, of the last two years, to the State that demonstrate that an Offeror meets at a minimum Dun and Bradstreet (D&B) credit rating of 3A2 or better, or a recognized equivalent rating. Please provide the Respondent’s D&B Number and the composite credit rating. The State reserves the right to verify this information. If a branch or wholly owned subsidiary is bidding on this RFP, please provide the D&B Number and score for the parent company that will be financially responsible for performance of the agreement.

6.4 (E) GENERAL INFORMATION

6.4.1 Provide any pertinent general information about the depth and breadth of your Solutions and their overall use and acceptance in the cloud marketplace.

6.4.2 Offeror must describe whether or not its auditing capabilities and reports are consistent with SAS 70 or later versions including, SSAE 16 6/2011, or greater.

6.5 (E) BILLING AND PRICING PRACTICES
DO NOT INCLUDE YOUR PRICING CATALOG, as part of your response to this question.

6.5.1 Describe your billing and pricing practices, including how your billing practices are transparent and easy to understand for Purchasing Entity’s.

6.5.2 Identify any typical cost impacts that a Purchasing Entity might need to consider, if any, to implement your cloud solutions.

6.5.3 Offeror must describe how its Solutions are NIST compliant, as defined in NIST Special Publication 800-145, with the service models it offers.

6.6 (E) SCOPE AND VARIETY OF CLOUD SOLUTIONS
Specify the scope and variety of the Solutions you offer under this solicitation. You may provide a list of the different SaaS, IaaS, and/or PaaS services and deployment models that you offer.

6.7 (E) BEST PRACTICES
Specify your policies and procedures in ensuring visibility, compliance, data security and threat protection for cloud-delivered services; include any implementations of encryption or tokenization to control access to sensitive data.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 33
#2..
- 77 -
23 7 ORGANIZATION AND STAFFING

7.1 (ME) CONTRACT MANAGER
The Offeror must provide a Contract Manager as the single point of contact for management of the NASPO ValuePoint Master Agreement, administered by the State of Utah. The Contract Manager must have experience managing contracts for cloud solutions.

7.1.1 Provide the name, phone number, email address, and work hours of the person who will act as Contract Manager if you are awarded a Master Agreement.

7.1.2 Describe in detail the Contract Manager’s experience managing contracts of similar size and scope to the one that will be awarded from this RFP. Provide a detailed resume for the Contract Manager.

7.1.3 Describe in detail the roles and responsibilities of the Contract Manager as they apply to the NASPO ValuePoint Master Agreement that will be awarded from this RFP.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 34
#2..
- 78 -
24 8 TECHNICAL REQUIREMENTS
If applicable to an Offeror’s Solution, an Offeror must provide a point by point responses to each technical requirement demonstrating its technical capabilities. If a technical requirement is not applicable to an Offeror’s Solution then the Offeror must explain why the technical requirement is not applicable.

8.1 (M)(E) TECHNICAL REQUIREMENTS

8.1.1 Offeror must identify the cloud service model(s) and deployment model(s) it intends to provide to Eligible Users. See Attachment D.

8.1.2 For the purposes of the RFP, meeting the NIST essential characteristics is a primary concern. As such, describe how your proposed solution(s) meet the following characteristics, as defined in NIST Special Publication 800-145:

8.1.2.1 NIST Characteristic - On-Demand Self-Service: Provide a brief written description of how the cloud solutions proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how self-service technical capability is met.

8.1.2.2 NIST Characteristic - Broad Network Access: Provide a brief written description of how the cloud solutions proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how network access is provided.

8.1.2.3 NIST Characteristic - Resource Pooling: Provide a brief written description of how the cloud solutions proposed satisfies this individual essential NIST Characteristic. Attest capability and briefly describe how resource pooling technical capability is met.

8.1.2.4 NIST Characteristic - Rapid Elasticity: Provide a brief written description of how the cloud solutions proposed satisfies this NIST Characteristic. Attest capability and briefly describe how rapid elasticity technical capability is met.

8.1.2.5 NIST Characteristic - Measured Service: Provide a brief written description of how the cloud solutions proposed satisfies this NIST Characteristic.

Attest capability and briefly describe how measured service technical capability is met.

8.1.3 Offeror must identify for each Solution the subcategories that it offers for each service model. For example if an Offeror provides a SaaS offering then it should be divided into education SaaS offerings, e-procurement SaaS offerings, information SaaS offering, etc.

8.1.4 As applicable to an Offeror’s proposal, Offeror must describe its willingness to comply with, the requirements of Attachments C & D.

8.1.5 As applicable to an Offeror’s proposal, Offeror must describe how its offerings adhere to the services, definitions, and deployment models identified in the Scope of Services, in Attachment D.

8.2 (E) SUBCONTRACTORS

8.2.1 Offerors must explain whether they intend to provide all cloud solutions directly or through the use of Subcontractors. Higher points may be earned by providing all services directly or by providing details of highly qualified Subcontractors; lower scores may be State of Utah Bid CH16012
3/22/2016 4:23 PM p. 35
#2..
- 79 -
25 earned for failure to provide detailed plans for providing services or failure to provide detail regarding specific Subcontractors. Any Subcontractor that an Offeror chooses to use in fulfilling the requirements of the RFP must also meet all Administrative, Business and Technical Requirements of the RFP, as applicable to the Solutions provided.

Subcontractors do not need to comply with Section 6.3.

8.2.2 Offeror must describe the extent to which it intends to use subcontractors to perform contract requirements. Include each position providing service and provide a detailed description of how the subcontractors are anticipated to be involved under the Master Agreement.

8.2.3 If the subcontractor is known, provide the qualifications of the subcontractor to provide the services; if not, describe how you will guarantee selection of a subcontractor that meets the experience requirements of the RFP. Include a description of how the Offeror will ensure that all subcontractors and their employees will meet all Statement of Work requirements.

8.3 (E) WORKING WITH PURCHASING ENTITIES

8.3.1 Offeror must describe how it will work with Purchasing Entities before, during, and after a Data Breach, as defined in the Attachments and Exhibits. Include information such as:
 Personnel who will be involved at various stages, include detail on how the Contract Manager in Section 7 will be involved;
 Response times;
 Processes and timelines;
 Methods of communication and assistance; and
 Other information vital to understanding the service you provide.

8.3.2 Offeror must describe how it will not engage in nor permit its agents to push adware, software, or marketing not explicitly authorized by the Participating Entity or the Master Agreement.

8.3.3 Offeror must describe whether its application-hosting environments support a user test/staging environment that is identical to production.

8.3.4 Offeror must describe whether or not its computer applications and Web sites are be accessible to people with disabilities, and must comply with Participating entity accessibility policies and the Americans with Disability Act, as applicable.

8.3.5 Offeror must describe whether or not its applications and content delivered through Web browsers are be accessible using current released versions of multiple browser platforms (such as Internet Explorer, Firefox, Chrome, and Safari) at minimum.

8.3.6 Offeror must describe how it will, prior to the execution of a Service Level Agreement, meet with the Purchasing Entity and cooperate and hold a meeting to determine whether any sensitive or personal information will be stored or used by the Offeror that is subject to any law, rule or regulation providing for specific compliance obligations.

8.3.7 Offeror must describe any project schedule plans or work plans that Offerors use in implementing their Solutions with customers. Offerors should include timelines for developing, testing, and implementing Solutions for customers.

8.4 (E) CUSTOMER SERVICE

8.4.1 Offeror must describe how it ensure excellent customer service is provided to Purchasing Entities. Include:
 Quality assurance measures;
 Escalation plan for addressing problems and/or complaints; and  Service Level Agreement (SLA).

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 36
#2..
- 80 -
26 8.4.2 Offeror must describe its ability to comply with the following customer service requirements:
a. You must have one lead representative for each entity that executes a Participating Addendum. Contact information shall be kept current. b. Customer Service Representative(s) must be available by phone or email at a minimum, from 7AM to 6PM on Monday through Sunday for the applicable time zones.
c. Customer Service Representative will respond to inquiries within one business day.
d. You must provide design services for the applicable categories. e. You must provide Installation Services for the applicable categories.

8.5 (E) SECURITY OF INFORMATION

8.5.1 Offeror must describe the measures it takes to protect data. Include a description of the method by which you will hold, protect, and dispose of data following completion of any contract services.

8.5.2 Offeror must describe how it intends to comply with all applicable laws and related to data privacy and security.

8.5.3 Offeror must describe how it will not access a Purchasing Entity’s user accounts or data, except in the course of data center operations, response to service or technical issues, as required by the express terms of the Master Agreement, the applicable Participating Addendum, and/or the applicable Service Level Agreement.

8.6 (E) PRIVACY AND SECURITY

8.6.1 Offeror must describe its commitment for its Solutions to comply with NIST, as defined in NIST Special Publication 800-145, and any other relevant industry standards, as it relates to the Scope of Services described in Attachment D, including supporting the different types of data that you may receive.

8.6.2 Offeror must list all government or standards organization security certifications it currently holds that apply specifically to the Offeror’s proposal, as well as those in process at time of response. Specifically include HIPAA, FERPA, CJIS Security Policy, PCI Data Security Standards (DSS), IRS Publication 1075, FISMA, NIST 800-53, NIST SP 800- 171, and FIPS 200 if they apply.

8.6.3 Offeror must describe its security practices in place to secure data and applications, including threats from outside the service center as well as other customers co-located within the same service center.

8.6.4 Offeror must describe its data confidentiality standards and practices that are in place to ensure data confidentiality. This must include not only prevention of exposure to unauthorized personnel, but also managing and reviewing access that administrators have to stored data. Include information on your hardware policies (laptops, mobile etc).

8.6.5 Offeror must provide a detailed list of the third-party attestations, reports, security credentials (e.g., FedRamp), and certifications relating to data security, integrity, and other controls.

8.6.6 Offeror must describe its logging process including the types of services and devices logged; the event types logged; and the information fields. You should include detailed response on how you plan to maintain security certifications.

8.6.7 Offeror must describe whether it can restrict visibility of cloud hosted data and documents to specific users or groups.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 37
#2..
- 81 -
27 8.6.8 Offeror must describe its notification process in the event of a security incident, including relating to timing, incident levels. Offeror should take into consideration that Purchasing Entities may have different notification requirements based on applicable laws and the categorization type of the data being processed or stored.

8.6.9 Offeror must describe and identify whether or not it has any security controls, both physical and virtual Zones of Control Architectures (ZOCA), used to isolate hosted servers.

8.6.10 Provide Security Technical Reference Architectures that support Infrastructure as a Service (IaaS), Software as a Service (SaaS) & Platform as a Service (PaaS).

8.6.11 Describe security procedures (background checks, foot printing logging, etc.) which are in place regarding Offeror’s employees who have access to sensitive data.

8.6.12 Describe the security measures and standards (i.e. NIST) which the Offeror has in place to secure the confidentiality of data at rest and in transit.

8.6.13 Describe policies and procedures regarding notification to both the State and the Cardholders of a data breach, as defined in this RFP, and the mitigation of such a breach.

8.7 (E) MIGRATION AND REDEPLOYMENT PLAN

8.7.1 Offeror must describe how it manages the end of life activities of closing down a service to a Purchasing Entity and safely deprovisioning it before the Offeror is no longer contractually obligated to maintain the service, include planned and unplanned activities. An Offeror’s response should include detail on how an Offeror maintains security of the data during this phase of an SLA, if the Offeror provides for redundancy during migration, and how portable the data is during migration.

8.7.2 Offeror must describe how it intends to provide an orderly return of data back to the Purchasing Entity, include any description in your SLA that describes the return of data to a customer.

8.8 (E) SERVICE OR DATA RECOVERY

8.8.1 Describe how you would respond to the following situations; include any contingency plan or policy.
a. Extended downtime.
b. Suffers an unrecoverable loss of data.
c. Offeror experiences a system failure.
d. Ability to recover and restore data within 4 business hours in the event of a severe system outage.
e. Describe your Recovery Point Objective (RPO) and Recovery Time Objective (RTO).

8.8.2 Describe your methodologies for the following backup and restore services:
a. Method of data backups
b. Method of server image backups
c. Digital location of backup storage (secondary storage, tape, etc.) d. Alternate data center strategies for primary data centers within the continental United States.

8.9 (E) DATA PROTECTION

8.9.1 Specify standard encryption technologies and options to protect sensitive data, depending on the particular service model that you intend to provide under this Master Agreement, while in transit or at rest.

8.9.2 Describe whether or not it is willing to sign relevant and applicable Business Associate Agreement or any other agreement that may be necessary to protect data with a Purchasing Entity.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 38
#2..
- 82 -
28 8.9.3 Offeror must describe how it will only use data for purposes defined in the Master Agreement, participating addendum, or related service level agreement. Offeror shall not use the government data or government related data for any other purpose including but not limited to data mining. Offeror or its subcontractors shall not resell nor otherwise redistribute information gained from its access to the data received as a result of this RFP.

8.10 (E) SERVICE LEVEL AGREEMENTS

8.10.1 Offeror must describe whether your sample Service Level Agreement is negotiable. If not describe how it benefits purchasing entity’s not to negotiate your Service Level Agreement.

8.10.2 Offeror, as part of its proposal, must provide a sample of its Service Level Agreement, which should define the performance and other operating parameters within which the infrastructure must operate to meet IT System and Purchasing Entity’s requirements.

8.11 (E) DATA DISPOSAL
Specify your data disposal procedures and policies and destruction confirmation process.

8.12 (E) PERFORMANCE MEASURES AND REPORTING

8.12.1 Describe your ability to guarantee reliability and uptime greater than 99.5%. Additional points will be awarded for 99.9% or greater availability.

8.12.2 Provide your standard uptime service and related Service Level Agreement (SLA) criteria.

8.12.3 Specify and provide the process to be used for the participating entity to call/contact you for support, who will be providing the support, and describe the basis of availability.

8.12.4 Describe the consequences/SLA remedies if the Respondent fails to meet incident response time and incident fix time.

8.12.5 Describe the firm’s procedures and schedules for any planned downtime.

8.12.6 Describe the consequences/SLA remedies if disaster recovery metrics are not met.

8.12.7 Provide a sample of performance reports and specify if they are available over the Web and if they are real-time statistics or batch statistics.

8.12.8 Ability to print historical, statistical, and usage reports locally.

8.12.9 Offeror must describe whether or not its on-demand deployment is supported 24x365.

8.12.10 Offeror must describe its scale-up and scale-down, and whether it is available 24x365.

8.13 (E) CLOUD SECURITY ALLIANCE
Describe your level of disclosure with CSA Star Registry for each Solution offered. a. Completion of a CSA STAR Self-Assessment, as described in Section 5.5.3. b. Completion of Exhibits 1 and 2 to Attachment B.
c. Completion of a CSA STAR Attestation, Certification, or Assessment. d. Completion CSA STAR Continuous Monitoring.

8.14 (E) SERVICE PROVISIONING

8.14. 1 Describe in detail how your firm processes emergency or rush services implementation requests by a Purchasing Entity.

8.14.2 Describe in detail the standard lead-time for provisioning your Solutions.

8.15 (E) BACK UP AND DISASTER PLAN

8.15.1 Ability to apply legal retention periods and disposition by agency per purchasing entity policy and/or legal requirements.

8.15.2 Describe any known inherent disaster recovery risks and provide potential mitigation strategies.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 39
#2..
- 83 -
29 8.15.3 Describe the infrastructure that supports multiple data centers within the United States, each of which supports redundancy, failover capability, and the ability to run large scale applications independently in case one data center is lost.

8.16 (E) SOLUTION ADMINISTRATION

8.16.1 Ability of the Purchasing Entity to fully manage identity and user accounts.

8.16.2 Ability to provide anti-virus protection, for data stores.

8.16.3 Ability to migrate all Purchasing Entity data, metadata, and usage data to a successor Cloud Hosting solution provider.

8.16.4 Ability to administer the solution in a distributed manner to different participating entities.

8.16.5 Ability to apply a participating entity's defined administration polices in managing a solution.

8.17 (E) HOSTING AND PROVISIONING

8.17.1 Documented cloud hosting provisioning processes, and your defined/standard cloud provisioning stack.

8.17.2 Provide tool sets at minimum for:

1. Deploying new servers (determining configuration for both stand alone or part of an existing server farm, etc.)

2. Creating and storing server images for future multiple deployments

3. Securing additional storage space

4. Monitoring tools for use by each jurisdiction’s authorized personnel – and this should ideally cover components of a public (respondent hosted) or hybrid cloud (including Participating entity resources).

8.18 (E) TRIAL AND TESTING PERIODS (PRE- AND POST- PURCHASE)

8.18.1 Describe your testing and training periods that your offer for your service offerings.

8.18.2 Describe how you intend to provide a test and/or proof of concept environment for evaluation that verifies your ability to meet mandatory requirements.

8.18.3 Offeror must describe what training and support it provides at no additional cost.

8.19 (E) INTEGRATION AND CUSTOMIZATION

8.19.1 Describe how the Solutions you provide can be integrated to other complementary applications, and if you offer standard-based interface to enable additional integrations.

8.19.2 Describe the ways to customize and personalize the Solutions you provide to meet the needs of specific Purchasing Entities.

8.20 (E) MARKETING PLAN
Describe your how you intend to market your Solutions to NASPO ValuePoint and Participating Entities.

8.21 (E) RELATED VALUE-ADDED SERVICES TO CLOUD SOLUTIONS Describe the valued-added services that you can provide as part of an awarded contract, e.g. consulting services pre- and post- implementation. Offerors may detail professional services in the RFP limited to assisting offering activities with initial setup, training and access to the services.

8.22 (E) SUPPORTING INFRASTRUCTURE

8.22.1 Describe what infrastructure is required by the Purchasing Entity to support your Solutions or deployment models.

8.22.2 If required, who will be responsible for installation of new infrastructure and who will incur those costs?

8.23 (E) ALIGNMENT OF CLOUD COMPUTING REFERENCE ARCHITECTURE State of Utah Bid CH16012
3/22/2016 4:23 PM p. 40
#2..
- 84 -
30 Clarify how your architecture compares to the NIST Cloud Computing Reference Architecture, in particular, to describe how they align with the three domains e.g. Infrastructure as a Service (IaaS), Software as a Service (SaaS), and Platform as a Service (PaaS).

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 41
#2..
- 85 -
31 9 COST PROPOSAL

9.1 (M) COST PROPOSAL
Given that technology products generally depreciate over time and go through typical product lifecycles, it is more favorable for Purchasing Entities to have the Master Agreement be based on minimum discounts off the Offeror’s’ commercially published pricelists versus fixed pricing. In addition, Offerors will have the ability to update and refresh their respective price books, as long as the agreed-upon discounts are fixed. Minimum guaranteed contract discounts do not preclude an Offeror and/or its authorized resellers from providing deeper or additional, incremental discounts at their sole discretion.

Offeror must identify its cost proposal, Attachment G, as “Cost Proposal – CH16012 Cloud solutions”. No specific format is required for an Offeror’s price schedule; however the Offeror must provide and list a discount from its pricing catalog. New discount levels may be offered for new services that become available during the term of the Master Agreement, as allowed by the Lead State.

Pricing catalogs should include the price structures of the cloud solutions models and deployment models that it intends to provide including the types of data it is able to hold under each model.

Pricing must be all-inclusive of infrastructure and software costs and management of infrastructure, network, OS, and software.

The Lead State understands that each Offeror may have its own pricing models and schedules for the Services described in the RFP. It is the intent to of the RFP to allow price schedules that are viewed in the traditional line item structure or price schedule that have pay-as-you-go characteristics.

An Offeror’s price catalog should be clear and readable. Participating Entities, in reviewing an Offeror’s Master Agreement, will take into account the discount offered by the Offeror along with the transparent, publicly available, up-to-date pricing and tools that will allow customers to evaluate their pricing.

Individual Participating Addendums will use the cost proposals pricing as a base and may negotiate an adjusted rate.

Offeror’s price catalog should be broken into category for each service category. For example if an Offeror provides a SaaS offering then its price catalog should be divided into education SaaS offerings, e-procurement SaaS offerings, information SaaS offering, etc.

Some Participating Entities may desire to use an Offeror for other related application modifications to optimize or deploy cloud solutions applications. Responses to the RFP must include hourly rates by job specialty for use by Participating Entities for these types of database/application administration, systems engineering & configuration services and consulting throughout the contract period. The hourly rates should be a fully burdened rate that includes labor, overhead, and any other costs related to the service. The specific rate (within a range) charged for each proposed contracted service would be the lowest rate shown unless justified in writing and approved by the Lead State. Any of these valued-added services must be included in your cost proposal, e.g., by an hourly rate.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 42
#2..
- 86 -

DRAFT ONLY
Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions

1. Master Agreement Order of Precedence
a. Any Order placed under this Master Agreement shall consist of the following documents:
(1) A Participating Entity’s Participating Addendum1(“PA”); (2) NASPO ValuePoint Master Agreement Terms & Conditions, including the applicable Exhibits2
to the Master Agreement;
(3) The Solicitation;
(4) Contractor’s response to the Solicitation, as revised (if permitted) and accepted by the Lead State; and
(5) A Service Level Agreement issued against the Participating Addendum. b. These documents shall be read to be consistent and complementary. Any conflict among these documents shall be resolved by giving priority to these documents in the order listed above. Contractor terms and conditions that apply to this Master Agreement are only those that are expressly accepted by the Lead State and must be in writing and attached to this Master Agreement as an Exhibit or Attachment.

2. Definitions - Unless otherwise provided in this Master Agreement, capitalized terms will have the meanings given to those terms in this Section.

Confidential Information means any and all information of any form that is marked as confidential or would by its nature be deemed confidential obtained by Contractor or its employees or agents in the performance of this Master Agreement, including, but not necessarily limited to (1) any Purchasing Entity’s records, (2) personnel records, and (3) information concerning individuals, is confidential information of Purchasing Entity.

Contractor means the person or entity providing solutions under the terms and conditions set forth in this Master Agreement. Contractor also includes its employees, subcontractors, agents and affiliates who are providing the services agreed to under the Master Agreement.

Data means all information, whether in oral or written (including electronic) form,

1 A Sample Participating Addendum will be published after the contracts have been awarded. 2 The Exhibits comprise the terms and conditions for the service models: PaaS, IaaS, and PaaS.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 43
#2..
- 87 -

DRAFT ONLY
created by or in any way originating with a Participating Entity or Purchasing Entity, and all information that is the output of any computer processing, or other electronic manipulation, of any information that was created by or in any way originating with a Participating Entity or Purchasing Entity, in the course of using and configuring the Services provided under this Agreement.

Data Breach means any actual or reasonably suspected non-authorized access to or acquisition of computerized Non-Public Data or Personal Data that compromises the security, confidentiality, or integrity of the Non-Public Data or Personal Data, or the ability of Purchasing Entity to access the Non-Public Data or Personal Data.

Data Categorization means the process of risk assessment of Data. See also “High Risk Data”, “Moderate Risk Data” and “Low Risk Data”.

Disabling Code means computer instructions or programs, subroutines, code, instructions, data or functions, (including but not limited to viruses, worms, date bombs or time bombs), including but not limited to other programs, data storage, computer libraries and programs that self-replicate without manual intervention, instructions programmed to activate at a predetermined time or upon a specified event, and/or programs purporting to do a meaningful function but designed for a different function, that alter, destroy, inhibit, damage, interrupt, interfere with or hinder the operation of the Purchasing Entity’s’ software, applications and/or its end users processing environment, the system in which it resides, or any other software or data on such system or any other system with which it is capable of communicating.

Fulfillment Partner means a third-party contractor qualified and authorized by Contractor, and approved by the Participating State under a Participating Addendum, who may, to the extent authorized by Contractor, fulfill any of the requirements of this Master Agreement including but not limited to providing Services under this Master Agreement and billing Customers directly for such Services. Contractor may, upon written notice to the Participating State, add or delete authorized Fulfillment Partners as necessary at any time during the contract term. Fulfillment Partner has no authority to amend this Master Agreement or to bind Contractor to any additional terms and conditions.

High Risk Data is as defined in FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (“High Impact Data”).

Infrastructure as a Service (IaaS) as used in this Master Agreement is defined the capability provided to the consumer to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications; and possibly limited control of select networking components (e.g., host firewalls).

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 44
#2..
- 88 -

DRAFT ONLY
Intellectual Property means any and all patents, copyrights, service marks, trademarks, trade secrets, trade names, patentable inventions, or other similar proprietary rights, in tangible or intangible form, and all rights, title, and interest therein.

Lead State means the State centrally administering the solicitation and any resulting Master Agreement(s).

Low Risk Data is as defined in FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (“Low Impact Data”).

Master Agreement means this agreement executed by and between the Lead State, acting on behalf of NASPO ValuePoint, and the Contractor, as now or hereafter amended.

Moderate Risk Data is as defined in FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (“Moderate Impact Data”).

NASPO ValuePoint is the NASPO ValuePoint Cooperative Purchasing Program, facilitated by the NASPO Cooperative Purchasing Organization LLC, a 501(c)(3) limited liability company (doing business as NASPO ValuePoint) is a subsidiary organization the National Association of State Procurement Officials (NASPO), the sole member of NASPO ValuePoint. The NASPO ValuePoint Cooperative Purchasing Organization facilitates administration of the cooperative group contracting consortium of state chief procurement officials for the benefit of state departments, institutions, agencies, and political subdivisions and other eligible entities (i.e., colleges, school districts, counties, cities, some nonprofit organizations, etc.) for all states and the District of Columbia. The NASPO ValuePoint Cooperative Development Team is identified in the Master Agreement as the recipient of reports and may be performing contract administration functions as assigned by the Lead State.

Non-Public Data means High Risk Data and Moderate Risk Data that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the Purchasing Entity because it contains information that is exempt by statute, ordinance or administrative rule from access by the general public as public information.

Participating Addendum means a bilateral agreement executed by a Contractor and a Participating Entity incorporating this Master Agreement and any other additional Participating Entity specific language or other requirements, e.g. ordering procedures specific to the Participating Entity, other terms and conditions.

Participating Entity means a state, or other legal entity, properly authorized to enter into a Participating Addendum.

Participating State means a state, the District of Columbia, or one of the territories of the United States that is listed in the Request for Proposal as intending to participate.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 45
#2..
- 89 -

DRAFT ONLY
Upon execution of the Participating Addendum, a Participating State becomes a Participating Entity.

Personal Data means data alone or in combination that includes information relating to an individual that identifies the individual by name, identifying number, mark or description can be readily associated with a particular individual and which is not a public record. Personal Information may include the following personally identifiable information (PII): government-issued identification numbers (e.g., Social Security, driver’s license, passport); financial account information, including account number, credit or debit card numbers; or Protected Health Information (PHI) relating to a person.

Platform as a Service (PaaS) as used in this Master Agreement is defined as the capability provided to the consumer to deploy onto the cloud infrastructure consumercreated or -acquired applications created using programming languages and tools supported by the provider. This capability does not necessarily preclude the use of compatible programming languages, libraries, services, and tools from other sources.

The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations.

Product means any deliverable under this Master Agreement, including Services, software, and any incidental tangible goods.

Protected Health Information (PHI) means individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by the Family Educational Rights and Privacy Act (FERPA), as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer. PHI may also include information that is a subset of health information, including demographic information collected from an individual, and (1) is created or received by a health care provider, health plan, employer or health care clearinghouse; and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (a) that identifies the individual; or (b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

Purchasing Entity means a state, city, county, district, other political subdivision of a State, and a nonprofit organization under the laws of some states if authorized by a Participating Addendum, who issues a Purchase Order against the Master Agreement and becomes financially committed to the purchase.

Services mean any of the specifications described in the Scope of Services that are supplied or created by the Contractor pursuant to this Master Agreement.

Security Incident means the possible or actual unauthorized access to a Purchasing State of Utah Bid CH16012
3/22/2016 4:23 PM p. 46
#2..
- 90 -

DRAFT ONLY
Entity’s Non-Public Data and Personal Data the Contractor believes could reasonably result in the use, disclosure or theft of a Purchasing Entity’s Non-Public Data within the possession or control of the Contractor. A Security Incident also includes a major security breach to the Contractor’s system, regardless if Contractor is aware of unauthorized access to a Purchasing Entity’s Non-Public Data. A Security Incident may or may not turn into a Data Breach.

Service Level Agreement (SLA) means a written agreement between both the Purchasing Entity and the Contractor that is subject to the terms and conditions in this Master Agreement and relevant Participating Addendum unless otherwise expressly agreed in writing between the Purchasing Entity and the Contractor. SLAs should include: (1) the technical service level performance promises, (i.e. metrics for performance and intervals for measure), (2) description of service quality, (3) identification of roles and responsibilities, (4) remedies, such as credits, and (5) an explanation of how remedies or credits are calculated and issued.

Software as a Service (SaaS) as used in this Master Agreement is defined as the capability provided to the consumer to use the Contractor’s applications running on a Contractor’s infrastructure (commonly referred to as ‘cloud infrastructure). The applications are accessible from various client devices through a thin client interface such as a Web browser (e.g., Web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

Solicitation means the documents used by the State of Utah, as the Lead State, to obtain Contractor’s Proposal.

Statement of Work means a written statement in a solicitation document or contract that describes the Purchasing Entity’s service needs and expectations.

3. Term of the Master Agreement: The initial term of this Master Agreement is for ten (10) years with no renewal options.

4. Amendments: The terms of this Master Agreement shall not be waived, altered, modified, supplemented or amended in any manner whatsoever without prior written approval of the Lead State and Contractor.

5. Assignment/Subcontracts: Contractor shall not assign, sell, transfer, or sublet rights, or delegate responsibilities under this Master Agreement, in whole or in part, without the prior written approval of the Lead State.

The Lead State reserves the right to assign any rights or duties, including written assignment of contract administration duties to the NASPO Cooperative Purchasing Organization LLC, doing business as NASPO ValuePoint.

6. Discount Guarantee Period: All discounts must be guaranteed for the entire term of the Master Agreement. Participating Entities and Purchasing Entities shall receive the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 47
#2..
- 91 -

DRAFT ONLY
immediate benefit of price or rate reduction of the services provided under this Master Agreement. A price or rate reduction will apply automatically to the Master Agreement and an amendment is not necessary.

7. Termination: Unless otherwise stated, this Master Agreement may be terminated by either party upon 60 days written notice prior to the effective date of the termination.

Further, any Participating Entity may terminate its participation upon 30 days written notice, unless otherwise limited or stated in the Participating Addendum. Termination may be in whole or in part. Any termination under this provision shall not affect the rights and obligations attending orders outstanding at the time of termination, including any right of any Purchasing Entity to indemnification by the Contractor, rights of payment for Services delivered and accepted, data ownership, Contractor obligations regarding Purchasing Entity Data, rights attending default in performance an applicable Service Level of Agreement in association with any Order, Contractor obligations under Termination and Suspension of Service, and any responsibilities arising out of a Security Incident or Data Breach. Termination of the Master Agreement due to Contractor default may be immediate.

8. Confidentiality, Non-Disclosure, and Injunctive Relief a. Confidentiality. Contractor acknowledges that it and its employees or agents may, in the course of providing a Product under this Master Agreement, be exposed to or acquire information that is confidential to Purchasing Entity’s or Purchasing Entity’s clients. Any reports or other documents or items (including software) that result from the use of the Confidential Information by Contractor shall be treated in the same manner as the Confidential Information. Confidential Information does not include information that (1) is or becomes (other than by disclosure by Contractor) publicly known; (2) is furnished by Purchasing Entity to others without restrictions similar to those imposed by this Master Agreement; (3) is rightfully in Contractor’s possession without the obligation of nondisclosure prior to the time of its disclosure under this Master Agreement; (4) is obtained from a source other than Purchasing Entity without the obligation of confidentiality, (5) is disclosed with the written consent of Purchasing Entity or; (6) is independently developed by employees, agents or subcontractors of Contractor who can be shown to have had no access to the Confidential Information. b. Non-Disclosure. Contractor shall hold Confidential Information in confidence, using at least the industry standard of confidentiality, and shall not copy, reproduce, sell, assign, license, market, transfer or otherwise dispose of, give, or disclose Confidential Information to third parties or use Confidential Information for any purposes whatsoever other than what is necessary to the performance of Orders placed under this Master Agreement. Contractor shall advise each of its employees and agents of their obligations to keep Confidential Information confidential. Contractor shall use commercially reasonable efforts to assist Purchasing Entity in identifying and preventing any unauthorized use or disclosure of any Confidential Information. Without limiting the generality of the foregoing, Contractor shall advise Purchasing Entity, applicable Participating Entity, and the Lead State immediately if Contractor learns or has reason to believe that any person who has had access to Confidential Information has violated or intends to violate the terms of this Master Agreement, and Contractor shall at its State of Utah Bid CH16012
3/22/2016 4:23 PM p. 48
#2..
- 92 -

DRAFT ONLY
expense cooperate with Purchasing Entity in seeking injunctive or other equitable relief in the name of Purchasing Entity or Contractor against any such person. Except as directed by Purchasing Entity, Contractor will not at any time during or after the term of this Master Agreement disclose, directly or indirectly, any Confidential Information to any person, except in accordance with this Master Agreement, and that upon termination of this Master Agreement or at Purchasing Entity’s request, Contractor shall turn over to Purchasing Entity all documents, papers, and other matter in Contractor's possession that embody Confidential Information. Notwithstanding the foregoing, Contractor may keep one copy of such Confidential Information necessary for quality assurance, audits and evidence of the performance of this Master Agreement. c. Injunctive Relief. Contractor acknowledges that breach of this section, including disclosure of any Confidential Information, will cause irreparable injury to Purchasing Entity that is inadequately compensable in damages. Accordingly, Purchasing Entity may seek and obtain injunctive relief against the breach or threatened breach of the foregoing undertakings, in addition to any other legal remedies that may be available.

Contractor acknowledges and agrees that the covenants contained herein are necessary for the protection of the legitimate business interests of Purchasing Entity and are reasonable in scope and content.
d. Purchasing Entity Law. These provisions shall be applicable only to extent they are not in conflict with the applicable public disclosure laws of any Purchasing Entity.

9. Right to Publish: Throughout the duration of this Master Agreement, Contractor must secure prior approval from the Lead State or Participating Entity for the release of any information that pertains to the potential work or activities covered by the Master Agreement , including but not limited to reference to or use of the Lead State or a Participating Entity’s name, Great Seal of the State, Coat of Arms, any Agency or other subunits of the State government, or any State official or employee, for commercial promotion which is strictly prohibited. News releases or release of broadcast e-mails pertaining to this Master Agreement or Participating Addendum shall not be made without prior written approval of the Lead State or a Participating Entity.

The Contractor shall not make any representations of NASPO ValuePoint’s opinion or position as to the quality or effectiveness of the services that are the subject of this Master Agreement without prior written consent. Failure to adhere to this requirement may result in termination of the Master Agreement for cause.

10. Defaults and Remedies
a. The occurrence of any of the following events shall be an event of default under this Master Agreement:
(1) Nonperformance of contractual requirements; or
(2) A material breach of any term or condition of this Master Agreement; or (3) Any certification, representation or warranty by Contractor in response to the solicitation or in this Master Agreement that proves to be untrue or materially misleading; or
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 49
#2..
- 93 -

DRAFT ONLY
(4) Institution of proceedings under any bankruptcy, insolvency, reorganization or similar law, by or against Contractor, or the appointment of a receiver or similar officer for Contractor or any of its property, which is not vacated or fully stayed within thirty (30) calendar days after the institution or occurrence thereof; or (5) Any default specified in another section of this Master Agreement. b. Upon the occurrence of an event of default, Lead State shall issue a written notice of default, identifying the nature of the default, and providing a period of 30 calendar days in which Contractor shall have an opportunity to cure the default. The Lead State shall not be required to provide advance written notice or a cure period and may immediately terminate this Master Agreement in whole or in part if the Lead State, in its sole discretion, determines that it is reasonably necessary to preserve public safety or prevent immediate public crisis. Time allowed for cure shall not diminish or eliminate Contractor’s liability for damages.
c. If Contractor is afforded an opportunity to cure and fails to cure the default within the period specified in the written notice of default, Contractor shall be in breach of its obligations under this Master Agreement and Lead State shall have the right to exercise any or all of the following remedies:
(1) Exercise any remedy provided by law; and
(2) Terminate this Master Agreement and any related Contracts or portions thereof; and
(3) Suspend Contractor from being able to respond to future bid solicitations; and
(4) Suspend Contractor’s performance; and
(5) Withhold payment until the default is remedied.
d. Unless otherwise specified in the Participating Addendum, in the event of a default under a Participating Addendum, a Participating Entity shall provide a written notice of default as described in this section and have all of the rights and remedies under this paragraph regarding its participation in the Master Agreement, in addition to those set forth in its Participating Addendum. Nothing in these Master Agreement Terms and Conditions shall be construed to limit the rights and remedies available to a Purchasing Entity under the applicable commercial code.

11. Changes in Contractor Representation: The Contractor must notify the Lead State of changes in the Contractor’s key administrative personnel, in writing within 10 calendar days of the change. The Lead State reserves the right to approve changes in key personnel, as identified in the Contractor’s proposal. The Contractor agrees to propose replacement key personnel having substantially equal or better education, training, and experience as was possessed by the key person proposed and evaluated in the Contractor’s proposal.

12. Force Majeure: Neither party shall be in default by reason of any failure in performance of this Contract in accordance with reasonable control and without fault or negligence on their part. Such causes may include, but are not restricted to, acts of nature or the public enemy, acts of the government in either its sovereign or contractual State of Utah Bid CH16012
3/22/2016 4:23 PM p. 50
#2..
- 94 -

DRAFT ONLY
capacity, fires, floods, epidemics, quarantine restrictions, strikes, freight embargoes and unusually severe weather, but in every case the failure to perform such must be beyond the reasonable control and without the fault or negligence of the party.

13. Indemnification
a. The Contractor shall defend, indemnify and hold harmless NASPO, NASPO ValuePoint, the Lead State, Participating Entities, and Purchasing Entities, along with their officers, agents, and employees as well as any person or entity for which they may be liable, from and against claims, damages or causes of action including reasonable attorneys’ fees and related costs for any death, injury, or damage to property arising directly or indirectly from act(s), error(s), or omission(s) of the Contractor, its employees or subcontractors or volunteers, at any tier, relating to the performance under the Master Agreement.
b. Indemnification – Intellectual Property. The Contractor shall defend, indemnify and hold harmless NASPO, NASPO ValuePoint, the Lead State, Participating Entities, Purchasing Entities, along with their officers, agents, and employees as well as any person or entity for which they may be liable ("Indemnified Party"), from and against claims, damages or causes of action including reasonable attorneys’ fees and related costs arising out of the claim that the Product or its use, infringes Intellectual Property rights ("Intellectual Property Claim") of another person or entity. (1) The Contractor’s obligations under this section shall not extend to any claims arising from the combination of the Product with any other product, system or method, unless the Product, system or method is:
(a) provided by the Contractor or the Contractor’s subsidiaries or affiliates; (b) specified by the Contractor to work with the Product; or (c) reasonably required, in order to use the Product in its intended manner, and the infringement could not have been avoided by substituting another reasonably available product, system or method capable of performing the same function; or
(d) It would be reasonably expected to use the Product in combination with such product, system or method.
(2) The Indemnified Party shall notify the Contractor within a reasonable time after receiving notice of an Intellectual Property Claim. Even if the Indemnified Party fails to provide reasonable notice, the Contractor shall not be relieved from its obligations unless the Contractor can demonstrate that it was prejudiced in defending the Intellectual Property Claim resulting in increased expenses or loss to the Contractor and then only to the extent of the prejudice or expenses. If the Contractor promptly and reasonably investigates and defends any Intellectual Property Claim, it shall have control over the defense and settlement of it. However, the Indemnified Party must consent in writing for any money damages or obligations for which it may be State of Utah Bid CH16012
3/22/2016 4:23 PM p. 51
#2..
- 95 -

DRAFT ONLY
responsible. The Indemnified Party shall furnish, at the Contractor’s reasonable request and expense, information and assistance necessary for such defense. If the Contractor fails to vigorously pursue the defense or settlement of the Intellectual Property Claim, the Indemnified Party may assume the defense or settlement of it and the Contractor shall be liable for all costs and expenses, including reasonable attorneys’ fees and related costs, incurred by the Indemnified Party in the pursuit of the Intellectual Property Claim. Unless otherwise agreed in writing, this section is not subject to any limitations of liability in this Master Agreement or in any other document executed in conjunction with this Master Agreement.

14. Independent Contractor: The Contractor shall be an independent contractor.

Contractor shall have no authorization, express or implied, to bind the Lead State, Participating States, other Participating Entities, or Purchasing Entities to any agreements, settlements, liability or understanding whatsoever, and agrees not to hold itself out as agent except as expressly set forth herein or as expressly agreed in any Participating Addendum.

15. Individual Customers: Except to the extent modified by a Participating Addendum, each Purchasing Entity shall follow the terms and conditions of the Master Agreement and applicable Participating Addendum and will have the same rights and responsibilities for their purchases as the Lead State has in the Master Agreement, including but not limited to, any indemnity or right to recover any costs as such right is defined in the Master Agreement and applicable Participating Addendum for their purchases. Each Purchasing Entity will be responsible for its own charges, fees, and liabilities. The Contractor will apply the charges and invoice each Purchasing Entity individually.

16. Insurance
a. Unless otherwise agreed in a Participating Addendum, Contractor shall, during the term of this Master Agreement, maintain in full force and effect, the insurance described in this section. Contractor shall acquire such insurance from an insurance carrier or carriers licensed to conduct business in each Participating Entity’s state and having a rating of A-, Class VII or better, in the most recently published edition of Best’s Reports.

Failure to buy and maintain the required insurance may result in this Master Agreement’s termination or, at a Participating Entity’s option, result in termination of its Participating Addendum.
b. Coverage shall be written on an occurrence basis. The minimum acceptable limits shall be as indicated below, with no deductible for each of the following categories:
(1) Commercial General Liability covering premises operations, independent contractors, products and completed operations, blanket contractual liability, personal injury (including death), advertising liability, and property damage, with a limit of not less than $1 million per occurrence/$3 million general aggregate;
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 52
#2..
- 96 -

DRAFT ONLY
(2) CLOUD MINIMUM INSURANCE COVERAGE:

Level of Risk
Data Breach and Privacy/Cyber Liability
including Technology Errors and Omissions
Minimum Insurance Coverage
Low Risk Data $2,000,000
Moderate Risk Data $5,000,000
High Risk Data $10,000,000
(3) Contractor must comply with any applicable State Workers Compensation or Employers Liability Insurance requirements.
(4) Professional Liability. As applicable, Professional Liability Insurance Policy in the minimum amount of $1,000,000 per occurrence and $1,000,000 in the aggregate, written on an occurrence form that provides coverage for its work undertaken pursuant to each Participating Addendum.
c. Contractor shall pay premiums on all insurance policies. Such policies shall also reference this Master Agreement and shall have a condition that they not be revoked by the insurer until thirty (30) calendar days after notice of intended revocation thereof shall have been given to Purchasing Entity and Participating Entity by the Contractor. d. Prior to commencement of performance, Contractor shall provide to the Lead State a written endorsement to the Contractor’s general liability insurance policy or other documentary evidence acceptable to the Lead State that (1) names the Participating States identified in the Request for Proposal as additional insureds, (2) provides that no material alteration, cancellation, non-renewal, or expiration of the coverage contained in such policy shall have effect unless the named Participating State has been given at least thirty (30) days prior written notice, and (3) provides that the Contractor’s liability insurance policy shall be primary, with any liability insurance of any Participating State as secondary and noncontributory. Unless otherwise agreed in any Participating Addendum, the Participating Entity’s rights and Contractor’s obligations are the same as those specified in the first sentence of this subsection. Before performance of any Purchase Order issued after execution of a Participating Addendum authorizing it, the Contractor shall provide to a Purchasing Entity or Participating Entity who requests it the same information described in this subsection.
e. Contractor shall furnish to the Lead State, Participating Entity, and, on request, the Purchasing Entity copies of certificates of all required insurance within thirty (30) calendar days of the execution of this Master Agreement, the execution of a Participating Addendum, or the Purchase Order’s effective date and prior to performing any work. The insurance certificate shall provide the following information: the name and address of the insured; name, address, telephone number and signature of the authorized agent; name of the insurance company (authorized to operate in all states); a description of coverage in detailed standard terminology (including policy period, policy number, limits of liability, exclusions and endorsements); and an acknowledgment State of Utah Bid CH16012
3/22/2016 4:23 PM p. 53
#2..
- 97 -

DRAFT ONLY
of the requirement for notice of cancellation. Copies of renewal certificates of all required insurance shall be furnished within thirty (30) days after any renewal date.

These certificates of insurance must expressly indicate compliance with each and every insurance requirement specified in this section. Failure to provide evidence of coverage may, at sole option of the Lead State, or any Participating Entity, result in this Master Agreement’s termination or the termination of any Participating Addendum. f. Coverage and limits shall not limit Contractor’s liability and obligations under this Master Agreement, any Participating Addendum, or any Purchase Order.

17. Laws and Regulations: Any and all Services offered and furnished shall comply fully with all applicable Federal and State laws and regulations.

18. No Waiver of Sovereign Immunity: In no event shall this Master Agreement, any Participating Addendum or any contract or any Purchase Order issued thereunder, or any act of a Lead State, a Participating Entity, or a Purchasing Entity be a waiver of any form of defense or immunity, whether sovereign immunity, governmental immunity, immunity based on the Eleventh Amendment to the Constitution of the United States or otherwise, from any claim or from the jurisdiction of any court.

This section applies to a claim brought against the Participating State only to the extent Congress has appropriately abrogated the Participating State’s sovereign immunity and is not consent by the Participating State to be sued in federal court. This section is also not a waiver by the Participating State of any form of immunity, including but not limited to sovereign immunity and immunity based on the Eleventh Amendment to the Constitution of the United States.

19. Ordering
a. Master Agreement order and purchase order numbers shall be clearly shown on all acknowledgments, shipping labels, packing slips, invoices, and on all correspondence. b. This Master Agreement permits Purchasing Entities to define project-specific requirements and informally compete the requirement among other firms having a Master Agreement on an “as needed” basis. This procedure may also be used when requirements are aggregated or other firm commitments may be made to achieve reductions in pricing. This procedure may be modified in Participating Addenda and adapted to Purchasing Entity rules and policies. The Purchasing Entity may in its sole discretion determine which firms should be solicited for a quote. The Purchasing Entity may select the quote that it considers most advantageous, cost and other factors considered.
c. Each Purchasing Entity will identify and utilize its own appropriate purchasing procedure and documentation. Contractor is expected to become familiar with the Purchasing Entities’ rules, policies, and procedures regarding the ordering of supplies and/or services contemplated by this Master Agreement.
d. Contractor shall not begin providing Services without a valid Service Level State of Utah Bid CH16012
3/22/2016 4:23 PM p. 54
#2..
- 98 -

DRAFT ONLY
Agreement or other appropriate commitment document compliant with the law of the Purchasing Entity.
e. Orders may be placed consistent with the terms of this Master Agreement during the term of the Master Agreement.
f. All Orders pursuant to this Master Agreement, at a minimum, shall include:
(1) The services or supplies being delivered;
(2) The place and requested time of delivery;
(3) A billing address;
(4) The name, phone number, and address of the Purchasing Entity representative;
(5) The price per unit or other pricing elements consistent with this Master Agreement and the contractor’s proposal;
(6) A ceiling amount of the order for services being ordered; and (7) The Master Agreement identifier and the Participating State contract identifier. g. All communications concerning administration of Orders placed shall be furnished solely to the authorized purchasing agent within the Purchasing Entity’s purchasing office, or to such other individual identified in writing in the Order. h. Orders must be placed pursuant to this Master Agreement prior to the termination date of this Master Agreement. Contractor is reminded that financial obligations of Purchasing Entities payable after the current applicable fiscal year are contingent upon agency funds for that purpose being appropriated, budgeted, and otherwise made available.
i. Notwithstanding the expiration or termination of this Master Agreement, Contractor agrees to perform in accordance with the terms of any Orders then outstanding at the time of such expiration or termination. Contractor shall not honor any Orders placed after the expiration or termination of this Master Agreement. Orders from any separate indefinite quantity, task orders, or other form of indefinite delivery order arrangement priced against this Master Agreement may not be placed after the expiration or termination of this Master Agreement, notwithstanding the term of any such indefinite delivery order agreement.

20. Participants and Scope
a. Contractor may not deliver Services under this Master Agreement until a Participating Addendum acceptable to the Participating Entity and Contractor is executed. The NASPO ValuePoint Master Agreement Terms and Conditions are applicable to any Order by a Participating Entity (and other Purchasing Entities covered by their Participating Addendum), except to the extent altered, modified, supplemented or amended by a Participating Addendum. By way of illustration and not limitation, this authority may apply to unique delivery and invoicing requirements, confidentiality requirements, defaults on Orders, governing law and venue relating to Orders by a State of Utah Bid CH16012
3/22/2016 4:23 PM p. 55
#2..
- 99 -

DRAFT ONLY
Participating Entity, indemnification, and insurance requirements. Statutory or constitutional requirements relating to availability of funds may require specific language in some Participating Addenda in order to comply with applicable law. The expectation is that these alterations, modifications, supplements, or amendments will be addressed in the Participating Addendum or, with the consent of the Purchasing Entity and Contractor, may be included in the ordering document (e.g. purchase order or contract) used by the Purchasing Entity to place the Order.
b. Subject to subsection 20c and a Participating Entity’s Participating Addendum, the use of specific NASPO ValuePoint cooperative Master Agreements by state agencies, political subdivisions and other Participating Entities (including cooperatives) authorized by individual state’s statutes to use state contracts is subject to the approval of the respective State Chief Procurement Official.
c. Unless otherwise stipulated in a Participating Entity’s Participating Addendum, specific services accessed through the NASPO ValuePoint cooperative Master Agreements for Cloud Services by state executive branch agencies, as required by a Participating Entity’s statutes, are subject to the authority and approval of the Participating Entity’s Chief Information Officer’s Office3 .
d. Obligations under this Master Agreement are limited to those Participating Entities who have signed a Participating Addendum and Purchasing Entities within the scope of those Participating Addenda. Financial obligations of Participating States are limited to the orders placed by the departments or other state agencies and institutions having available funds. Participating States incur no financial obligations on behalf of political subdivisions.
e. NASPO ValuePoint is not a party to the Master Agreement. It is a nonprofit cooperative purchasing organization assisting states in administering the NASPO ValuePoint cooperative purchasing program for state government departments, institutions, agencies and political subdivisions (e.g., colleges, school districts, counties, cities, etc.) for all 50 states, the District of Columbia and the territories of the United States.
f. Participating Addenda shall not be construed to amend the terms of this Master Agreement between the Lead State and Contractor.

g. Participating Entities who are not states may under some circumstances sign their own Participating Addendum, subject to the approval of participation by the Chief Procurement Official of the state where the Participating Entity is located. Coordinate requests for such participation through NASPO ValuePoint. Any permission to participate through execution of a Participating Addendum is not a determination that procurement authority exists in the Participating Entity; they must ensure that they have the requisite procurement authority to execute a Participating Addendum.

3 Chief Information Officer means the individual designated by the Governor with Executive Branch, enterprisewide responsibility for the leadership and management of information technology resources of a state.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 56
#2..
- 100 -

DRAFT ONLY
h. Resale. Subject to any explicit permission in a Participating Addendum, Purchasing Entities may not resell goods, software, or Services obtained under this Master Agreement. This limitation does not prohibit: payments by employees of a Purchasing Entity as explicitly permitted under this agreement; sales of goods to the general public as surplus property; and fees associated with inventory transactions with other governmental or nonprofit entities under cooperative agreements and consistent with a Purchasing Entity’s laws and regulations. Any sale or transfer permitted by this subsection must be consistent with license rights granted for use of intellectual property.

21. Payment: Unless otherwise stipulated in the Participating Addendum, Payment is normally made within 30 days following the date of a correct invoice is received.

Purchasing Entities reserve the right to withhold payment of a portion (including all if applicable) of disputed amount of an invoice. After 45 days the Contractor may assess overdue account charges up to a maximum rate of one percent per month on the outstanding balance. Payments will be remitted by mail. Payments may be made via a State or political subdivision “Purchasing Card” with no additional charge.

22. Data Access Controls: Contractor will provide access to Purchasing Entity’s Data only to those Contractor employees, contractors and subcontractors (“Contractor Staff”) who need to access the Data to fulfill Contractor’s obligations under this Agreement.

Contractor shall not access a Purchasing Entity’s user accounts or Data, except on the course of data center operations, response to service or technical issues, as required by the express terms of this Master Agreement, or at a Purchasing Entity’s written request.

Contractor may not share a Purchasing Entity’s Data with its parent corporation, other affiliates, or any other third party without the Purchasing Entity’s express written consent.

Contractor will ensure that, prior to being granted access to the Data, Contractor Staff who perform work under this Agreement have successfully completed annual instruction of a nature sufficient to enable them to effectively comply with all Data protection provisions of this Agreement; and possess all qualifications appropriate to the nature of the employees’ duties and the sensitivity of the Data they will be handling.

23. Operations Management: Contractor shall maintain the administrative, physical, technical, and procedural infrastructure associated with the provision of the Product in a manner that is, at all times during the term of this Master Agreement, at a level equal to or more stringent than those specified in the Solicitation.

24. Public Information: This Master Agreement and all related documents are subject to disclosure pursuant to the Purchasing Entity’s public information laws.

25. Purchasing Entity Data: Purchasing Entity retains full right and title to Data provided by it and any Data derived therefrom, including metadata.

DRAFT ONLY
sold to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. The obligation shall extend beyond the term of this Master Agreement in perpetuity.

Contractor shall not use any information collected in connection with this Master Agreement, including Purchasing Entity Data, for any purpose other than fulfilling its obligations under this Master Agreement.

26. Records Administration and Audit.
a. The Contractor shall maintain books, records, documents, and other evidence pertaining to this Master Agreement and orders placed by Purchasing Entities under it to the extent and in such detail as shall adequately reflect performance and administration of payments and fees. Contractor shall permit the Lead State, a Participating Entity, a Purchasing Entity, the federal government (including its grant awarding entities and the U.S. Comptroller General), and any other duly authorized agent of a governmental agency, to audit, inspect, examine, copy and/or transcribe Contractor's books, documents, papers and records directly pertinent to this Master Agreement or orders placed by a Purchasing Entity under it for the purpose of making audits, examinations, excerpts, and transcriptions. This right shall survive for a period of six (6) years following termination of this Agreement or final payment for any order placed by a Purchasing Entity against this Agreement, whichever is later, to assure compliance with the terms hereof or to evaluate performance hereunder. b. Without limiting any other remedy available to any governmental entity, the Contractor shall reimburse the applicable Lead State, Participating Entity, or Purchasing Entity for any overpayments inconsistent with the terms of the Master Agreement or orders or underpayment of fees found as a result of the examination of the Contractor’s records.
c. The rights and obligations herein exist in addition to any quality assurance obligation in the Master Agreement requiring the Contractor to self-audit contract obligations and that permits the Lead State to review compliance with those obligations. d. The Contractor shall allow the Purchasing Entity to audit conformance to the Master Agreement and applicable Participating Addendum terms. The purchasing entity may perform this audit or contract with a third party at its discretion and at the purchasing entity’s expense.

27. Administrative Fees: The Contractor shall pay to NASPO ValuePoint, or its assignee, a NASPO ValuePoint Administrative Fee of one-quarter of one percent (0.25% or 0.0025) no later than 60 days following the end of each calendar quarter. The NASPO ValuePoint Administrative Fee shall be submitted quarterly and is based on sales of the Services. The NASPO ValuePoint Administrative Fee is not negotiable. This fee is to be included as part of the pricing submitted with proposal.

Additionally, some states may require an additional administrative fee be paid directly to State of Utah Bid CH16012
3/22/2016 4:23 PM p. 58
#2..
- 102 -

DRAFT ONLY
the state on purchases made by Purchasing Entities within that state. For all such requests, the fee level, payment method and schedule for such reports and payments will be incorporated into the Participating Addendum that is made a part of the Master Agreement. The Contractor may adjust the Master Agreement pricing accordingly for purchases made by Purchasing Entities within the jurisdiction of the state. All such agreements shall not affect the NASPO ValuePoint Administrative Fee percentage or the prices paid by the Purchasing Entities outside the jurisdiction of the state requesting the additional fee. The NASPO ValuePoint Administrative Fee shall be based on the gross amount of all sales at the adjusted prices (if any) in Participating Addenda.

28. System Failure or Damage: In the event of system failure or damage caused by Contractor or its Services, the Contractor agrees to use its best efforts to restore or assist in restoring the system to operational capacity.

29. Title to Product: If access to the Product requires an application program interface (API), Contractor shall convey to Purchasing Entity an irrevocable and perpetual license to use the API.

30. Data Privacy: The Contractor must comply with all applicable laws related to data privacy and security, including IRS Pub 1075. Prior to entering into a SLA with a Purchasing Entity, the Contractor and Purchasing Entity must cooperate and hold a meeting to determine the Data Categorization to determine whether the Contractor will hold, store, or process High Risk Data, Moderate Risk Data and Low Risk Data. The Contractor must document the Data Categorization in the SLA or Statement of Work.

31. Warranty: At a minimum the Contractor must warrant the following:
a. Contractor has acquired any and all rights, grants, assignments, conveyances, licenses, permissions, and authorization for the Contractor to provide the Services described in this Master Agreement.
b. Contractor will perform materially as described in this Master Agreement, SLA, Statement of Work, including any performance representations contained in the Contractor’s response to the Solicitation by the Lead State. c. Contractor represents and warrants that the representations contained in its response to the Solicitation by the Lead State.
d. The Contractor will not interfere with a Purchasing Entity’s access to and use of the Services it acquires from this Master Agreement.
e. The Services provided by the Contractor are compatible with and will operate successfully with any environment (including web browser and operating system) specified by the Contractor in its response to the Solicitation by the Lead State. f. The Contractor warrants that the Products it provides under this Master Agreement State of Utah Bid CH16012
3/22/2016 4:23 PM p. 59
#2..
- 103 -

DRAFT ONLY
are free of malware. The Contractor must use industry-leading technology to detect and remove worms, Trojans, rootkits, rogues, dialers, spyware, etc.

32. Transition Assistance:
a. The Contractor shall reasonably cooperate with other parties in connection with all Services to be delivered under this Master Agreement, including without limitation any successor service provider to whom a Purchasing Entity’s Data is transferred in connection with the termination or expiration of this Master Agreement. The Contractor shall assist a Purchasing Entity in exporting and extracting a Purchasing Entity’s Data, in a format usable without the use of the Services and as agreed by a Purchasing Entity, at no additional cost to the Purchasing Entity. Any transition services requested by a Purchasing Entity involving additional knowledge transfer and support may be subject to a separate transition Statement of Work.
b. A Purchasing Entity and the Contractor shall, when reasonable, create a Transition Plan Document identifying the transition services to be provided and including a Statement of Work if applicable.
c. The Contractor must maintain the confidentiality and security of a Purchasing Entity’s Data during the transition services and thereafter as required by the Purchasing Entity.

33. Waiver of Breach: Failure of the Lead State, Participating Entity, or Purchasing Entity to declare a default or enforce any rights and remedies shall not operate as a waiver under this Master Agreement or Participating Addendum. Any waiver by the Lead State, Participating Entity, or Purchasing Entity must be in writing. Waiver by the Lead State or Participating Entity of any default, right or remedy under this Master Agreement or Participating Addendum, or by Purchasing Entity with respect to any Purchase Order, or breach of any terms or requirements of this Master Agreement, a Participating Addendum, or Purchase Order shall not be construed or operate as a waiver of any subsequent default or breach of such term or requirement, or of any other term or requirement under this Master Agreement, Participating Addendum, or Purchase Order.

34. Assignment of Antitrust Rights: Contractor irrevocably assigns to a Participating Entity who is a state any claim for relief or cause of action which the Contractor now has or which may accrue to the Contractor in the future by reason of any violation of state or federal antitrust laws (15 U.S.C. § 1-15 or a Participating Entity’s state antitrust provisions), as now in effect and as may be amended from time to time, in connection with any goods or services provided to the Contractor for the purpose of carrying out the Contractor's obligations under this Master Agreement or Participating Addendum, including, at a Participating Entity's option, the right to control any such litigation on such claim for relief or cause of action.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 60
#2..
- 104 -

DRAFT ONLY

35. Debarment : The Contractor certifies, to the best of its knowledge, that neither it nor its principals are presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation in this transaction (contract) by any governmental department or agency. This certification represents a recurring certification made at the time any Order is placed under this Master Agreement. If the Contractor cannot certify this statement, attach a written explanation for review by the Lead State.

36. Performance and Payment Time Frames that Exceed Contract Duration: All maintenance or other agreements for services entered into during the duration of an SLA and whose performance and payment time frames extend beyond the duration of this Master Agreement shall remain in effect for performance and payment purposes (limited to the time frame and services established per each written agreement). No new leases, maintenance or other agreements for services may be executed after the Master Agreement has expired. For the purposes of this section, renewals of maintenance, subscriptions, SaaS subscriptions and agreements, and other service agreements, shall not be considered as “new.”

37. Governing Law and Venue
a. The procurement, evaluation, and award of the Master Agreement shall be governed by and construed in accordance with the laws of the Lead State sponsoring and administering the procurement. The construction and effect of the Master Agreement after award shall be governed by the law of the state serving as Lead State (in most cases also the Lead State). The construction and effect of any Participating Addendum or Order against the Master Agreement shall be governed by and construed in accordance with the laws of the Participating Entity’s or Purchasing Entity’s State. b. Unless otherwise specified in the RFP, the venue for any protest, claim, dispute or action relating to the procurement, evaluation, and award is in the Lead State. Venue for any claim, dispute or action concerning the terms of the Master Agreement shall be in the state serving as Lead State. Venue for any claim, dispute, or action concerning any Order placed against the Master Agreement or the effect of a Participating Addendum shall be in the Purchasing Entity’s State.
c. If a claim is brought in a federal forum, then it must be brought and adjudicated solely and exclusively within the United States District Court for (in decreasing order of priority): the Lead State for claims relating to the procurement, evaluation, award, or contract performance or administration if the Lead State is a party; the Participating State if a named party; the Participating Entity state if a named party; or the Purchasing Entity state if a named party.
d. This section is also not a waiver by the Participating State of any form of immunity, including but not limited to sovereign immunity and immunity based on the Eleventh Amendment to the Constitution of the United States.

38. No Guarantee of Service Volumes: The Contractor acknowledges and agrees that the Lead State and NASPO ValuePoint makes no representation, warranty or condition State of Utah Bid CH16012
3/22/2016 4:23 PM p. 61
#2..
- 105 -

DRAFT ONLY
as to the nature, timing, quality, quantity or volume of business for the Services or any other products and services that the Contractor may realize from this Master Agreement, or the compensation that may be earned by the Contractor by offering the Services. The Contractor acknowledges and agrees that it has conducted its own due diligence prior to entering into this Master Agreement as to all the foregoing matters.

39. NASPO ValuePoint eMarket Center: In July 2011, NASPO ValuePoint entered into a multi-year agreement with SciQuest, Inc. whereby SciQuest will provide certain electronic catalog hosting and management services to enable eligible NASPO ValuePoint’s customers to access a central online website to view and/or shop the goods and services available from existing NASPO ValuePoint Cooperative Contracts.

The central online website is referred to as the NASPO ValuePoint eMarket Center.

The Contractor will have visibility in the eMarket Center through Ordering Instructions.

These Ordering Instructions are available at no cost to the Contractor and provided customers information regarding the Contractors website and ordering information.

40. Contract Provisions for Orders Utilizing Federal Funds: Pursuant to Appendix II to 2 Code of Federal Regulations (CFR) Part 200, Contract Provisions for Non-Federal Entity Contracts Under Federal Awards, Orders funded with federal funds may have additional contractual requirements or certifications that must be satisfied at the time the Order is placed or upon delivery. These federal requirements may be proposed by Participating Entities in Participating Addenda and Purchasing Entities for incorporation in Orders placed under this master agreement.

41. Government Support: No support, facility space, materials, special access, personnel or other obligations on behalf of the states or other Participating Entities, other than payment, are required under the Master Agreement.

42. NASPO ValuePoint Summary and Detailed Usage Reports: In addition to other reports that may be required by this solicitation, the Contractor shall provide the following NASPO ValuePoint reports.
a. Summary Sales Data. The Contractor shall submit quarterly sales reports directly to NASPO ValuePoint using the NASPO ValuePoint Quarterly Sales/Administrative Fee Reporting Tool found at http://www.naspo.org/WNCPO/Calculator.aspx. Any/all sales made under the contract shall be reported as cumulative totals by state. Even if Contractor experiences zero sales during a calendar quarter, a report is still required.

Reports shall be due no later than 30 day following the end of the calendar quarter (as specified in the reporting tool).

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 62
#2..
- 106 -

DRAFT ONLY
b. Detailed Sales Data. Contractor shall also report detailed sales data by: (1) state; (2) entity/customer type, e.g. local government, higher education, K12, non-profit; (3) Purchasing Entity name; (4) Purchasing Entity bill-to and ship-to locations; (4) Purchasing Entity and Contractor Purchase Order identifier/number(s); (5) Purchase Order Type (e.g. sales order, credit, return, upgrade, determined by industry practices); (6) Purchase Order date; (7) and line item description, including product number if used.

The report shall be submitted in any form required by the solicitation. Reports are due on a quarterly basis and must be received by the Lead State and NASPO ValuePoint Cooperative Development Team no later than thirty (30) days after the end of the reporting period. Reports shall be delivered to the Lead State and to the NASPO ValuePoint Cooperative Development Team electronically through a designated portal, email, CD-Rom, flash drive or other method as determined by the Lead State and NASPO ValuePoint. Detailed sales data reports shall include sales information for all sales under Participating Addenda executed under this Master Agreement. The format for the detailed sales data report is in shown in Attachment F. c. Reportable sales for the summary sales data report and detailed sales data report includes sales to employees for personal use where authorized by the solicitation and the Participating Addendum. Report data for employees should be limited to ONLY the state and entity they are participating under the authority of (state and agency, city, county, school district, etc.) and the amount of sales. No personal identification numbers, e.g. names, addresses, social security numbers or any other numerical identifier, may be submitted with any report.
d. Contractor shall provide the NASPO ValuePoint Cooperative Development Coordinator with an executive summary each quarter that includes, at a minimum, a list of states with an active Participating Addendum, states that Contractor is in negotiations with and any PA roll out or implementation activities and issues. NASPO ValuePoint Cooperative Development Coordinator and Contractor will determine the format and content of the executive summary. The executive summary is due 30 days after the conclusion of each calendar quarter.
e. Timely submission of these reports is a material requirement of the Master Agreement. The recipient of the reports shall have exclusive ownership of the media containing the reports. The Lead State and NASPO ValuePoint shall have a perpetual, irrevocable, non-exclusive, royalty free, transferable right to display, modify, copy, and otherwise use reports, data and information provided under this section. f. If requested by a Participating Entity, the Contractor must provide detailed sales data within the Participating State.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 63
#2..
- 107 -

DRAFT ONLY

43. Entire Agreement: This Master Agreement, along with any attachment, contains the entire understanding of the parties hereto with respect to the Master Agreement unless a term is modified in a Participating Addendum with a Participating Entity. No click-through, or other end user terms and conditions or agreements required by the Contractor (“Additional Terms”) provided with any Services hereunder shall be binding on Participating Entities or Purchasing Entities, even if use of such Services requires an affirmative “acceptance” of those Additional Terms before access is permitted.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 64
#2..
- 108 -
Exhibit 1 to the Master Agreement: Software-as-a-Service

1. Data Ownership: The Purchasing Entity will own all right, title and interest in its data that is related to the Services provided by this Master Agreement. The Contractor shall not access Purchasing Entity user accounts or Purchasing Entity data, except (1) in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of this Master Agreement, Participating Addendum, SLA, and/or other contract documents, or (4) at the Purchasing Entity’s written request.

Contractor shall not collect, access, or use user-specific Purchasing Entity Data except as strictly necessary to provide Service to the Purchasing Entity. No information regarding a Purchasing Entity’s use of the Service may be disclosed, provided, rented or sold to any third party for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. This obligation shall survive and extend beyond the term of this Master Agreement.

2. Data Protection: Protection of personal privacy and data shall be an integral part of the business activities of the Contractor to ensure there is no inappropriate or unauthorized use of Purchasing Entity information at any time. To this end, the Contractor shall safeguard the confidentiality, integrity and availability of Purchasing Entity information and comply with the following conditions:
a. The Contractor shall implement and maintain appropriate administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of Personal Data and Non-Public Data. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures the Contractor applies to its own Personal Data and Non-Public Data of similar kind. b. All data obtained by the Contractor in the performance of the Master Agreement shall become and remain the property of the Purchasing Entity. c. All Personal Data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, the Contractor is responsible for encryption of the Personal Data. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in the service level agreement (SLA), or otherwise made a part of the Master Agreement. d. Unless otherwise stipulated, the Contractor shall encrypt all Non-Public Data at rest and in transit. The Purchasing Entity shall identify data it deems as Non-Public Data to the Contractor.

The level of protection and encryption for all Non-Public Data shall be identified in the SLA. e. At no time shall any data or processes — that either belong to or are intended for the use of a Purchasing Entity or its officers, agents or employees — be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the Purchasing Entity.
f. The Contractor shall not use any information collected in connection with the Services issued from this Master Agreement for any purpose other than fulfilling the Services.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 65
#2..
- 109 -

3. Data Location: The Contractor shall provide its services to the Purchasing Entity and its end users solely from data centers in the U.S. Storage of Purchasing Entity data at rest shall be located solely in data centers in the U.S. The Contractor shall not allow its personnel or contractors to store Purchasing Entity data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Contractor shall permit its personnel and contractors to access Purchasing Entity data remotely only as required to provide technical support. The Contractor may provide technical user support on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited in a Participating Addendum.

4. Security Incident or Data Breach Notification:
a. Incident Response: Contractor may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the contract.

Discussing security incidents with the Purchasing Entity should be handled on an urgent asneeded basis, as part of Contractor’s communication and mitigation processes as mutually agreed upon, defined by law or contained in the Master Agreement. b. Security Incident Reporting Requirements: The Contractor shall report a security incident to the Purchasing Entity identified contact immediately as soon as possible or promptly without out reasonable delay, or as defined in the SLA.
c. Breach Reporting Requirements: If the Contractor has actual knowledge of a confirmed data breach that affects the security of any purchasing entity’s content that is subject to applicable data breach notification law, the Contractor shall (1) as soon as possible or promptly without out reasonable delay notify the Purchasing Entity, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the data breach in a timely manner.

5. Personal Data Breach Responsibilities: This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor. a. The Contractor, unless stipulated otherwise, shall immediately notify the appropriate Purchasing Entity identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident. b. The Contractor, unless stipulated otherwise, shall promptly notify the appropriate Purchasing Entity identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it has confirmed that there is, or reasonably believes that there has been a Data Breach. The Contractor shall (1) cooperate with the Purchasing Entity as reasonably requested by the Purchasing Entity to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 66
#2..
- 110 -
c. Unless otherwise stipulated, if a data breach is a direct result of Contractor’s breach of its contractual obligation to encrypt personal data or otherwise prevent its release as reasonably determined by the Purchasing Entity, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws — all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $217 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause.

6. Notification of Legal Requests: The Contractor shall contact the Purchasing Entity upon receipt of any electronic discovery, litigation holds, discovery searches and expert testimonies related to the Purchasing Entity’s data under the Master Agreement, or which in any way might reasonably require access to the data of the Purchasing Entity. The Contractor shall not respond to subpoenas, service of process and other legal requests related to the Purchasing Entity without first notifying and obtaining the approval of the Purchasing Entity, unless prohibited by law from providing such notice.

7. Termination and Suspension of Service:
a. In the event of a termination of the Master Agreement or applicable Participating Addendum, the Contractor shall implement an orderly return of purchasing entity’s data in a CSV or another mutually agreeable format at a time agreed to by the parties or allow the Purchasing Entity to extract it’s data and the subsequent secure disposal of purchasing entity’s data. b. During any period of service suspension, the Contractor shall not take any action to intentionally erase or otherwise dispose of any of the Purchasing Entity’s data. c. In the event of termination of any services or agreement in entirety, the Contractor shall not take any action to intentionally erase purchasing entity’s data for a period of:
• 10 days after the effective date of termination, if the termination is in accordance with the contract period
• 30 days after the effective date of termination, if the termination is for convenience • 60 days after the effective date of termination, if the termination is for cause After such period, the Contractor shall have no obligation to maintain or provide any purchasing entity’s data and shall thereafter, unless legally prohibited, delete all purchasing entity’s data in its systems or otherwise in its possession or under its control.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 67
#2..
- 111 -
d. The purchasing entity shall be entitled to any post termination assistance generally made available with respect to the services, unless a unique data retrieval arrangement has been established as part of an SLA.
e. Upon termination of the Services or the Agreement in its entirety, Contractor shall securely dispose of all Purchasing Entity’s data in all of its forms, such as disk, CD/ DVD, backup tape and paper, unless stipulated otherwise by the Purchasing Entity. Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST)-approved methods. Certificates of destruction shall be provided to the Purchasing Entity.

8. Background Checks: Upon the request of the Purchasing Entity, the Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Master Agreement who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Contractor shall promote and maintain an awareness of the importance of securing the Purchasing Entity’s information among the Contractor’s employees and agents. If any of the stated personnel providing services under a Participating Addendum is not acceptable to the Purchasing Entity in its sole opinion as a result of the background or criminal history investigation, the Purchasing Entity, in its’ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the Participating Addendum and any related service agreement.

9. Access to Security Logs and Reports: The Contractor shall provide reports on a schedule specified in the SLA to the Purchasing Entity in a format as specified in the SLA agreed to by both the Contractor and the Purchasing Entity. Reports shall include latency statistics, user access, user access IP address, user access history and security logs for all public jurisdiction files related to this Master Agreement and applicable Participating Addendum.

10. Contract Audit: The Contractor shall allow the Purchasing Entity to audit conformance to the Master Agreement terms. The Purchasing Entity may perform this audit or contract with a third party at its discretion and at the Purchasing Entity’s expense.

11. Data Center Audit: The Contractor shall perform an independent audit of its data centers at least annually at its expense, and provide an unredacted version of the audit report upon request to a Purchasing Entity. The Contractor may remove its proprietary information from the unredacted version.

A Service Organization Control (SOC) 2 audit report or approved equivalent sets the minimum level of a third-party audit.

12. Change Control and Advance Notice: The Contractor shall give a minimum forty eight (48) hour advance notice (or as determined by a Purchasing Entity and included in the SLA) to the Purchasing Entity of any upgrades (e.g., major upgrades, minor upgrades, system changes) that may impact service availability and performance. A major upgrade is a replacement of hardware, software or firmware with a newer or better version in order to bring the system up to date or to improve its characteristics. It usually includes a new version number.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 68
#2..
- 112 -
Contractor will make updates and upgrades available to Purchasing Entity at no additional costs when Contractor makes such updates and upgrades generally available to its users.

No update, upgrade or other charge to the Service may decrease the Service’s functionality, adversely affect Purchasing Entity’s use of or access to the Service, or increase the cost of the Service to the Purchasing Entity.

Contractor will notify the Purchasing Entity at least sixty (60) days in advance prior to any major update or upgrade.

13. Security: As requested by a Purchasing Entity, the Contractor shall disclose its non-proprietary system security plans (SSP) or security processes and technical limitations to the Purchasing Entity such that adequate protection and flexibility can be attained between the Purchasing Entity and the Contractor. For example: virus checking and port sniffing — the Purchasing Entity and the Contractor shall understand each other’s roles and responsibilities.

14. Non-disclosure and Separation of Duties: The Contractor shall enforce separation of job duties, require commercially reasonable non-disclosure agreements, and limit staff knowledge of Purchasing Entity data to that which is absolutely necessary to perform job duties.

15. Import and Export of Data: The Purchasing Entity shall have the ability to import or export data in piecemeal or in entirety at its discretion without interference from the Contractor at any time during the term of Contractor’s contract with the Purchasing Entity. This includes the ability for the Purchasing Entity to import or export data to/from other Contractors. Contractor shall specify if Purchasing Entity is required to provide its’ own tools for this purpose, including the optional purchase of Contractors tools if Contractors applications are not able to provide this functionality directly.

16. Responsibilities and Uptime Guarantee: The Contractor shall be responsible for the acquisition and operation of all hardware, software and network support related to the services being provided. The technical and professional activities required for establishing, managing and maintaining the environments are the responsibilities of the Contractor. The system shall be available 24/7/365 (with agreed-upon maintenance downtime), and provide service to customers as defined in the SLA.

17. Subcontractor Disclosure: Contractor shall identify all of its strategic business partners related to services provided under this Master Agreement, including but not limited to all subcontractors or other entities or individuals who may be a party to a joint venture or similar agreement with the Contractor, and who shall be involved in any application development and/or operations.

18. Right to Remove Individuals: The Purchasing Entity shall have the right at any time to require that the Contractor remove from interaction with Purchasing Entity any Contractor representative who the Purchasing Entity believes is detrimental to its working relationship with the Contractor. The Purchasing Entity shall provide the Contractor with notice of its determination, and the reasons it requests the removal. If the Purchasing Entity signifies that a potential security violation exists with respect to the request, the Contractor shall immediately remove such individual. The Contractor shall not assign the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 69
#2..
- 113 -
person to any aspect of the Master Agreement or future work orders without the Purchasing Entity’s consent.

19. Business Continuity and Disaster Recovery: The Contractor shall provide a business continuity and disaster recovery plan upon request and ensure that the Purchasing Entity’s recovery time objective (RTO) of XXX hours/days is met. (XXX hour/days shall be provided to Contractor by the Purchasing Entity.) Contractor must work with the Purchasing Entity to perform an annual Disaster Recovery test and take action to correct any issues detected during the test in a time frame mutually agreed between the Contractor and the Purchasing Entity.

20. Compliance with Accessibility Standards: The Contractor shall comply with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973, or any other state laws or administrative regulations identified by the Participating Entity.

21. Web Services: The Contractor shall use Web services exclusively to interface with the Purchasing Entity’s data in near real time.

22. Encryption of Data at Rest: The Contractor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data, unless the Purchasing Entity approves in writing for the storage of Personal Data on a Contractor portable device in order to accomplish work as defined in the statement of work.

23. Subscription Terms: Contractor grants to a Purchasing Entity a license to: (i) access and use the Service for its business purposes; (ii) for SaaS, use underlying software as embodied or used in the Service; and (iii) view, copy, upload and download (where applicable), and use Contractor’s documentation.

No Contractor terms, including standard click through license or website terms or use of privacy policy, shall apply to Purchasing Entities unless such terms are included in this Master Agreement.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 70
#2..
- 114 -
Exhibit 2 to the Master Agreement: Platform-as-a-Service

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 71
#2..
- 115 -

4. Security Incident or Data Breach Notification: The Contractor shall inform the Purchasing Entity of any security incident or data breach within the possession and control of the Contractor and related to the service provided under the Master Agreement, Participating Addendum, or SLA. Such notice shall include, to the best of Contractor’s knowledge at that time, the persons affected, their identities, and the Confidential Information and Data disclosed, or shall include if this information is unknown. a. Incident Response: The Contractor may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the Master Agreement, Participating Addendum, or SLA. Discussing security incidents with the Purchasing Entity should be handled on an urgent as-needed basis, as part of Contractor’s communication and mitigation processes as mutually agreed, defined by law or contained in the Master Agreement, Participating Addendum, or SLA.
b. Security Incident Reporting Requirements: Unless otherwise stipulated, the Contractor shall immediately report a security incident related to its service under the Master Agreement, Participating Addendum, or SLA to the appropriate Purchasing Entity. c. Breach Reporting Requirements: If the Contractor has actual knowledge of a confirmed data breach that affects the security of any Purchasing Entity data that is subject to applicable data breach notification law, the Contractor shall (1) promptly notify the appropriate Purchasing Entity within 24 hours or sooner, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the data breach in a timely manner

5. Breach Responsibilities: This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor. a. The Contractor, unless stipulated otherwise, shall immediately notify the appropriate Purchasing Entity identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident. b. The Contractor, unless stipulated otherwise, shall promptly notify the appropriate Purchasing Entity identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it has confirmed that there is, or reasonably believes that there has been a data breach. The Contractor shall (1) cooperate with the Purchasing Entity as reasonably State of Utah Bid CH16012
3/22/2016 4:23 PM p. 72
#2..
- 116 -
requested by the Purchasing Entity to investigate and resolve the data breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the data breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary. c. Unless otherwise stipulated, if a Data Breach is a direct result of Contractor’s breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws — all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $217 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 73
#2..
- 117 -
d. The Purchasing Entity shall be entitled to any post termination assistance generally made available with respect to the services, unless a unique data retrieval arrangement has been established as part of an SLA.
e. Upon termination of the Services or the Agreement in its entirety, Contractor shall securely dispose of all Purchasing Entity’s data in all of its forms, such as disk, CD/ DVD, backup tape and paper, unless stipulated otherwise by the Purchasing Entity. Data shall be permanently deleted and shall not be recoverable, according to National Institute of Standards and Technology (NIST)-approved methods. Certificates of destruction shall be provided to the Purchasing Entity.

8. Background Checks:
a. Upon the request of the Purchasing Entity, the Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, to fulfill the obligations of the Master Agreement who have been convicted of any crime of dishonesty, including but not limited to criminal fraud, or otherwise convicted of any felony or misdemeanor offense for which incarceration for up to 1 year is an authorized penalty. The Contractor shall promote and maintain an awareness of the importance of securing the Purchasing Entity’s information among the Contractor’s employees and agents.
b. The Contractor and the Purchasing Entity recognize that security responsibilities are shared.

The Contractor is responsible for providing a secure infrastructure. The Purchasing Entity is responsible for its secure guest operating system, firewalls and other logs captured within the guest operating system. Specific shared responsibilities are identified within the SLA. c. If any of the stated personnel providing services under a Participating Addendum is not acceptable to the Purchasing Entity in its sole opinion as a result of the background or criminal history investigation, the Purchasing Entity, in its’ sole option shall have the right to either (1) request immediate replacement of the person, or (2) immediately terminate the Participating Addendum and any related service agreement.

9. Access to Security Logs and Reports:
a. The Contractor shall provide reports on a schedule specified in the SLA to the Purchasing Entity in a format as specified in the SLA and agreed to by both the Contractor and the Purchasing Entity. Reports will include latency statistics, user access, user access IP address, user access history and security logs for all Purchasing Entity files related to the Master Agreement, Participating Addendum, or SLA.
b. The Contractor and the Purchasing Entity recognize that security responsibilities are shared.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 74
#2..
- 118 -

A Service Organization Control (SOC) 2 audit report or approved equivalent sets the minimum level of a third-party audit.

Contractor will make updates and upgrades available to Purchasing Entity at no additional costs when Contractor makes such updates and upgrades generally available to its users.

Contractor will notify the Purchasing Entity at least sixty (60) days in advance prior to any major update or upgrade.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 75
#2..
- 119 -

18. Business Continuity and Disaster Recovery: The Contractor shall provide a business continuity and disaster recovery plan upon request and ensure that the Purchasing Entity’s recovery time objective (RTO) of XXX hours/days is met. (XXX hour/days shall be provided to Contractor by the Purchasing Entity.) Contractor must work with the Purchasing Entity to perform an annual Disaster Recovery test and take action to correct any issues detected during the test in a time frame mutually agreed between the Contractor and the Purchasing Entity.

19. Compliance with Accessibility Standards: The Contractor shall comply with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973 or any other state laws or administrative regulations identified by the Participating Entity..

20. Web Services: The Contractor shall use Web services exclusively to interface with the Purchasing Entity’s data in near real time.

21. Encryption of Data at Rest: The Contractor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data as identified in the SLA, unless the Contractor presents a justifiable position that is approved by the Purchasing Entity that Personal Data, is required to be stored on a Contractor portable device in order to accomplish work as defined in the scope of work.

22. Subscription Terms: Contractor grants to a Purchasing Entity a license to: (i) access and use the Service for its business purposes; (ii) for PaaS, use underlying software as embodied or used in the Service; and (iii) view, copy, upload and download (where applicable), and use Contractor’s documentation.

No Contractor terms, including standard click through license or website terms or use of privacy policy, shall apply to Purchasing Entities unless such terms are included in this Master Agreement.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 76
#2..
- 120 -
Exhibit 3 to the Master Agreement: Infrastructure-as-a-Service

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 77
#2..
- 121 -

4. Security Incident or Data Breach Notification: The Contractor shall inform the Purchasing Entity of any security incident or data breach related to Purchasing Entity’s Data within the possession or control of the Contractor and related to the service provided under the Master Agreement, Participating Addendum, or SLA. Such notice shall include, to the best of Contractor’s knowledge at that time, the persons affected, their identities, and the Confidential Information and Data disclosed, or shall include if this information is unknown.
a. Security Incident Reporting Requirements: The Contractor shall report a security incident to the Purchasing Entity identified contact immediately as soon as possible or promptly without out reasonable delay, or as defined in the SLA.
b. Breach Reporting Requirements: If the Contractor has actual knowledge of a confirmed data breach that affects the security of any purchasing entity’s content that is subject to applicable data breach notification law, the Contractor shall (1) as soon as possible or promptly without out reasonable delay notify the Purchasing Entity, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the data breach in a timely manner.

5. Breach Responsibilities: This section only applies when a Data Breach occurs with respect to Personal Data within the possession or control of the Contractor and related to the service provided under the Master Agreement, Participating Addendum, or SLA.
a. The Contractor, unless stipulated otherwise, shall immediately notify the appropriate Purchasing Entity identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident. b. The Contractor, unless stipulated otherwise, shall promptly notify the appropriate Purchasing Entity identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it has confirmed that there is, or reasonably believes that there has been a data breach. The Contractor shall (1) cooperate with the Purchasing Entity as reasonably requested by the Purchasing Entity to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 78
#2..
- 122 -
c. Unless otherwise stipulated, if a Data Breach is a direct result of Contractor’s breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws — all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $217 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the data breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause.

7. Termination and Suspension of Service:
a. In the event of an early termination of the Master Agreement, Participating or SLA, Contractor shall allow for the Purchasing Entity to retrieve its digital content and provide for the subsequent secure disposal of the Purchasing Entity’s digital content. b. During any period of service suspension, the Contractor shall not take any action to intentionally erase or otherwise dispose of any of the Purchasing Entity’s data. c. In the event of early termination of any Services or agreement in entirety, the Contractor shall not take any action to intentionally erase any Purchasing Entity’s data for a period of 1) 45 days after the effective date of termination, if the termination is for convenience; or 2) 60 days after the effective date of termination, if the termination is for cause. After such day period, the Contractor shall have no obligation to maintain or provide any Purchasing Entity data and shall thereafter, unless legally prohibited, delete all Purchasing Entity data in its systems or otherwise in its possession or under its control. In the event of either termination for cause, the Contractor will impose no fees for access and retrieval of digital content to the Purchasing Entity. d. The Purchasing Entity shall be entitled to any post termination assistance generally made available with respect to the services, unless a unique data retrieval arrangement has been established as part of an SLA.
e. Upon termination of the Services or the Agreement in its entirety, Contractor shall securely dispose of all Purchasing Entity’s data in all of its forms, such as disk, CD/ DVD, backup tape and paper, unless stipulated otherwise by the Purchasing Entity. Data shall be permanently deleted State of Utah Bid CH16012
3/22/2016 4:23 PM p. 79
#2..
- 123 -
and shall not be recoverable, according to National Institute of Standards and Technology (NIST)-approved methods. Certificates of destruction shall be provided to the Purchasing Entity.

9. Access to Security Logs and Reports:
a. The Contractor shall provide reports on a schedule specified in the SLA to the Contractor directly related to the infrastructure that the Contractor controls upon which the Purchasing Entity’s account resides. Unless otherwise agreed to in the SLA, the Contractor shall provide the public jurisdiction a history or all API calls for the Purchasing Entity account that includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters and the response elements returned by the Contractor. The report will be sufficient to enable the Purchasing Entity to perform security analysis, resource change tracking and compliance auditing
b. The Contractor and the Purchasing Entity recognize that security responsibilities are shared.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 80
#2..
- 124 -

11. Data Center Audit: The Contractor shall perform an independent audit of its data centers at least annually and at its own expense, and provide an unredacted version of the audit report upon request.

The Contractor may remove its proprietary information from the unredacted version. For example, a Service Organization Control (SOC) 2 audit report would be sufficient.

Contractor will make updates and upgrades available to Purchasing Entity at no additional costs when Contractor makes such updates and upgrades generally available to its users.

Contractor will notify the Purchasing Entity at least sixty (60) days in advance prior to any major update or upgrade.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 81
#2..
- 125 -

19. Subscription Terms: Contractor grants to a Purchasing Entity a license to: (i) access and use the Service for its business purposes; (ii) for IaaS, use underlying software as embodied or used in the Service; and (iii) view, copy, upload and download (where applicable), and use Contractor’s documentation.

No Contractor terms, including standard click through license or website terms or use of privacy policy, shall apply to Purchasing Entities unless such terms are included in this Master Agreement.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 82
#2..
- 126 -
Attachment B: Cloud Security Alliance Questionnaires
Cloud providers can submit two different types of reports to indicate their compliance with CSA best practices:
 The Consensus Assessments Initiative Questionnaire (CAIQ), which provides industry-accepted ways to document what security controls exist in IaaS, PaaS and SaaS offerings. The questionnaire (CAIQ) provides a set of over 140 questions a cloud consumer and cloud auditor may wish to ask of a cloud provider. Providers may opt to submit a completed Consensus Assessments Initiative Questionnaire.
 The Cloud Controls Matrix (CCM), which provides a controls framework that gives detailed understanding of security concepts and principles that are aligned to the Cloud Security Alliance guidance in 13 domains. As a framework, the CSA CCM provides organizations with the needed structure, detail and clarity relating to information security tailored to the cloud industry.

Providers may choose to submit a report documenting compliance with Cloud Controls Matrix.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 83
#2..
- 127 -
AICPA
TSC 2009
AICPA
Trust Service Criteria (SOC 2SM Report)
AICPA
TSC
2014
BITS Shared
Assessments
AUP v5.0
BITS Shared
Assessments
SIG v6.0
BSI
Germany Canada PIPEDA CCM V1.X COBIT 4.1 COBIT 5.0 COPPA CSA
Guidance
V3.0

ENISA IAF
95/46/EC - European
Union Data Protection
Directive
FedRAMP Security
Controls
(Final Release, Jan
2012)
--LOW IMPACT LEVEL--
FedRAMP Security Controls
(Final Release, Jan 2012)
--MODERATE IMPACT LEVEL--
FERPA
GAPP
(Aug
2009)

HIPAA/HITECH
(Omnibus
Rule)

ISO/IEC
27001:2005

ISO/IEC
27001:2013 ITAR Jericho Forum
Mexico - Federal Law on
Protection of Personal
Data Held by Private
Parties
NERC
CIP NIST SP800-53 R3 NIST SP800-53 R4 Appendix J NZISM PCI DSS v2.0 PCI DSS v3.0 Yes No Not
Applicable
Domain >
Container >
Capability
Public Private PA ID PA level
AIS-01.1 Do you use industry standards (Build Security in Maturity Model [BSIMM] benchmarks, Open Group ACS Trusted Technology
Provider Framework, NIST, etc.) to build in security for your Systems/Software Development Lifecycle (SDLC)?
AIS-01.2 Do you use an automated source code analysis tool to detect security defects in code prior to production?
AIS-01.3 Do you use manual source-code analysis to detect security defects in code prior to production?
AIS-01.4 Do you verify that all of your software suppliers adhere to industry standards for Systems/Software Development Lifecycle (SDLC) security?
AIS-01.5 (SaaS only) Do you review your applications for security vulnerabilities and address any issues prior to deployment to production?
AIS-02.1 Are all identified security, contractual and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets and information systems? AIS- 02.2 Are all requirements and trust levels for customers’ access defined and documented?
Application & Interface
Security
Data Integrity
AIS-03 AIS-03.1 Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.

Are data input and output integrity routines (i.e., reconciliation and edit checks) implemented for application interfaces and databases to prevent manual or systematic processing errors or corruption of data?
S3.4 (I3.2.0) The procedures related to completeness,
accuracy, timeliness, and authorization of inputs
are consistent with the documented system
processing integrity policies.
(I3.3.0) The procedures related to completeness,
accuracy, timeliness, and authorization of system
processing, including error correction and database
management, are consistent with documented
system processing integrity policies.
(I3.4.0) The procedures related to completeness,
accuracy, timeliness, and authorization of outputs
are consistent with the documented system
processing integrity policies.
(I3.5.0) There are procedures to enable tracing of
information inputs from their source to their final
disposition and vice versa.

PI1.2
PI1.3
PI1.5
I.4 G.16.3, I.3 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-05 DSS06.02
DSS06.04
312.8 and 312.10 Application
Services >
Programming
Interfaces > Input
Validation
shared x Domain 10 NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-9
NIST SP 800-53 R3 SI-10
NIST SP 800-53 R3 SI-11

1.2.6 45 CFR 164.312
(c)(1) (New)
45 CFR 164.312
(c)(2)(New)
45 CFR
164.312(e)(2)(i)(
New)
A.10.9.2
A.10.9.3
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.6.1
A.15.2.1
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
Commandment #1
Commandment #9
Commandment
#11
CIP-003-3 -
R4.2
SI-10
SI-11
SI-2
SI-3
SI-4
SI-6
SI-7
SI-9
AR-7 The organization
designs information
systems to support
privacy by automating
privacy controls.

14.5 14.6
PA25 GP PCI DSS v2.0

6.3.1 PCI DSS v2.0

6.3.2 6.3.1

6.3.2 Application & Interface
Security
Data Security / Integrity
AIS-04 AIS-04.1 Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity and availability) across multiple system interfaces, jurisdictions and business functions to prevent improper disclosure, alternation, or destruction.

Is your Data Security Architecture designed using an industry standard (e.g., CDSA, MULITSAFE, CSA Trusted Cloud Architectural Standard, FedRAMP, CAESARS)?
(S3.4) Procedures exist to protect against
unauthorized access to system resources.

CC5.6 B.1 G.8.2.0.2,
G.8.2.0.3,
G.12.1, G.12.4,
G.12.9,
G.12.10,
G.16.2,
G.19.2.1,
G.19.3.2,
G.9.4, G.17.2,
G.17.3, G.17.4,
G.20.1
6 (B)
26 (A+)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-03 COBIT 4.1 DS5.11 APO09.01
APO09.02
APO09.03
APO13.01
DSS05.02
DSS06.06
MEA03.01
MEA03.02
312.8 and 312.10 BOSS > Data
Governance >
Rules for
Information
Leakage
Prevention
shared x Domain 10 6.02. (b)

6.04.03. (a)
Article 17 (1), (2),(3), (4) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-4
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-8

1.1.0 1.2.2

1.2.6 4.2.3

5.2.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4

8.2.1 8.2.2

8.2.3 8.2.5

9.2.1 A.10.8.1
A.10.8.2
A.11.1.1
A.11.6.1
A.11.4.6
A.12.3.1
A.12.5.4
A.15.1.4
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
All AC-1
AC-4
SC-1
SC-16
AR-7 The organization
designs information
systems to support
privacy by automating
privacy controls.

16.5 16.8

17.4 PA20
PA25
PA29
GP
P
SGP
PCI DSS v2.0

2.3 PCI DSS v2.0

3.4.1,
PCI DSS v2.0

4.1 PCI DSS v2.0

4.1.1 PCI DSS v2.0

6.1 PCI DSS v2.0

6.3.2a
PCI DSS v2.0

6.5c
PCI DSS v2.0

8.3 PCI DSS v2.0

10.5.5 PCI DSS v2.0

11.5 2.3

3.4.1 4.1

4.1.1 6.1

6.3.2a

6.5c, 7.1, 7.2, 7.3,

8.1, 8.2, 8.3, 8.4,

8.5, 8.6, 8.7, 8.8

10.5.5, 10.8

11.5, 11.6
Audit Assurance &
Compliance
Audit Planning
AAC01AAC-01.1 Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.

Do you produce audit assertions using a structured, industry accepted format (e.g., CloudAudit/A6 URI Ontology, CloudTrust, SCAP/CYBEX, GRC XML, ISACA's Cloud Computing Management Audit/Assurance Program, etc.)?
S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically
reviewed and compared with the defined system
security policies.
(S4.2.0) There is a process to identify and address
potential impairments to the entity’s ongoing
ability to achieve its objectives in accordance with
its defined system security policies.

CC4.1 L.1, L.2, L.7,
L.9, L.11
58 (B) CO-01 COBIT 4.1 ME

2.1, ME 2.2 PO

9.5 PO 9.6
APO12.04
APO12.05
APO12.06
MEA02.01
MEA02.02
Title 16 Part 312 BOSS >
Compliance >
Audit Planning
shared x Domain 2,
4 6.01. (d) NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 PL-6

10.2.5 45 CFR
164.312(b)
Clause 4.2.3 e)
Clause 4.2.3b
Clause 5.1 g
Clause 6
A.15.3.1
Clauses

4.3(a),

4.3(b),

5.1(e),

5.1(f),

6.2(e),

9.1,

9.1(e),

9.2,

9.3(f),
Commandment #1
Commandment #2
Commandment #3
CA-2
CA-7
PL-6
AR-4 Privacy Auditing and
Monitoring. To promote
accountability,
organizations identify and
address gaps in privacy
compliance,
management,
operational, and technical
controls by conducting
regular assessments

5.1, 5.3, 5.4 PA15 SGP PCI DSS v2.0

2.1.2.b
AAC-02.1 Do you allow tenants to view your SOC2/ISO 27001 or similar thirdparty audit or certification reports? AAC-02.2 Do you conduct network penetration tests of your cloud service infrastructure regularly as prescribed by industry best practices and guidance?
AAC-02.3 Do you conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance?
AAC-02.4 Do you conduct internal audits regularly as prescribed by industry best practices and guidance?
AAC-02.5 Do you conduct external audits regularly as prescribed by industry best practices and guidance?
AAC-02.6 Are the results of the penetration tests available to tenants at their request?
AAC-02.7 Are the results of internal and external audits available to tenants at their request?
AAC-02.8 Do you have an internal audit program that allows for crossfunctional audit of assessments? AAC-03.1 Do you have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data?
AAC-03.2 Do you have capability to recover data for a specific customer in the case of a failure or data loss?
AAC-03.3 Do you have the capability to restrict the storage of customer data to specific countries or geographic locations?
AAC-03.4 Do you have a program in place that includes the ability to monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements? BCR-01.1 Do you provide tenants with geographically resilient hosting options? BCR-01.2 Do you provide tenants with infrastructure service failover capability to other providers?
Business Continuity
Management &
Operational Resilience
Business Continuity
Testing
BCR-02 BCR-02.1 Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.

Are business continuity plans subject to test at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness?
A3.3 (A3.3) Procedures exist to provide for backup,
offsite storage, restoration, and disaster recovery
consistent with the entity’s defined system
availability and related security policies.

A1.2 K.1.3, K.1.4.3,
K.1.4.6,
K.1.4.7,
K.1.4.8,
K.1.4.9,
K.1.4.10,
K.1.4.11,
K.1.4.12
52 (B)
55 (A+)
RS-04 DSS04.04 BOSS >
Operational Risk
Management >
Business
Continuity
provider x Domain 7,
8 6.07.01. (b)

6.07.01. (j)

6.07.01. (l)
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-2 (1)
NIST SP800-53 R3 CP-2 (2)
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-4 (1)
45 CFR 164.308
(a)(7)(ii)(D)
A.14.1.5 A17.3.1 Commandment #1
Commandment #2
Commandment #3
CP-2
CP-3
CP-4

4.4 5.2(time limit)

6.3(whenever change
occurs)
PA15 SGP PCI DSS v2.0

12.9.2 12.9.2, 12.10.2
BCR-03.1 Do you provide tenants with documentation showing the transport route of their data between your systems?
BCR-03.2 Can tenants define how their data is transported and through which legal jurisdictions?
Business Continuity
Management &
Operational Resilience
Documentation
BCR-04 BCR-04.1 Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following:
• Configuring, installing, and operating the information system • Effectively using the system’s security features
Are information system documents (e.g., administrator and user guides, architecture diagrams, etc.) made available to authorized personnel to ensure configuration, installation and operation of the information system?
S3.11.0
A.2.1.0
(S3.11.0) Procedures exist to provide that
personnel responsible for the design,
development, implementation, and operation of
systems affecting security have the qualifications
and resources to fulfill their responsibilities.
(A.2.1.0) The entity has prepared an objective
description of the system and its boundaries and
communicated such description to authorized
users.

CC1.3
CC1.4
CC2.1
G.1.1 56 (B)
57 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
OP-02 COBIT 4.1 DS 9,
DS 13.1
BAI08
BAI10
DSS01.01
312.8 and 312.10 SRM > Policies
and Standards >
Job Aid Guidelines
shared x Domain 7,
8 Article 17 NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3)
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 CP-10 (2)
NIST SP 800-53 R3 CP-10 (3)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)

1.2.6 Clause 4.3.3
A.10.7.4
Clause 9.2(g) Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment
#11
CIP-005-
3a - R1.3
CIP-007-3 -
R9
CP-9
CP-10
SA-5
SA-10
SA-11

10.5 13.5

17.1 PCI DSS v2.0

12.1 PCI DSS v2.0

12.2 PCI DSS v2.0

12.3 PCI DSS v2.0

12.4 1.1.2, 1.1.3, 2.2,

12.3 12.6
Business Continuity
Management &
Operational Resilience
Environmental Risks
BCR-05 BCR-05.1 Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied.

Is physical protection against damage (e.g., natural causes, natural disasters, deliberate attacks) anticipated and designed with countermeasures applied?
A3.1.0
A3.2.0
(A3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system availability commitments
and (2) assess the risks associated with the
identified threats.
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.

CC3.1
A1.1
A1.2
F.1 F.2.9,
F.1.2.21,
F.5.1, F.1.5.2,
F.2.1, F.2.7,
F.2.8
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RS-05 DSS01.03
DSS01.04
DSS01.05
Infra Services >
Facility Security >
Environmental
Risk
Management
provider x Domain 7,
8 6.07. (d)

6.08. (a)

6.09. (a)

6.09. (b)

6.09. (d)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-18

8.2.4 45 CFR 164.308
(a)(7)(i)
45 CFR
164.310(a)(2)(ii)
(New)
A.9.1.4
A.9.2.1
A11.1.4,
A11.2.1
Commandment #1
Commandment #2
Commandment #3
CIP-004-3
R3.2
PE-1
PE-13
PE-14
PE-15
PE-18

8.1 8.4
PA15 SGP 3.5.2, 3.6.3, 3.7,

5.1, 5.2, 5.3,

6.1, 6.2,

7.1, 7.2,

9.1, 9.2, 9.3, 9.4,

9.5, 9.6,

9.7, 9.8, 9.9,

12.2 Business Continuity
Management &
Operational Resilience
Equipment Location
BCR-06 BCR-06.1 To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance.

Are any of your data centers located in places that have a high probability/occurrence of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes, etc.)?
A3.1.0
A3.2.0
(A3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system availability commitments
and (2) assess the risks associated with the
identified threats.
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.

CC3.1
A1.1
A1.2
F.1 F.2.9,
F.1.2.21,
F.5.1, F.1.5.2,
F.2.1, F.2.7,
F.2.8
53 (A+)
75 (C+,
A+)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RS-06 DSS01.04
DSS01.05
312.8 and 312.10 Infra Services >
Facility Security >
Environmental
Risk
Management
provider x Domain 7,
8 6.07. (d)

6.08. (a)

6.09. (a)

6.09. (b)

6.09. (d)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-5
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-18
45 CFR 164.310
(c)
A.9.2.1 A11.2.1 Commandment #1
Commandment #2
Commandment #3
PE-1
PE-5
PE-14
PE-15
PE-18

8.1 PA15 SGP PCI DSS v2.0

9.1.3 PCI DSS v2.0

9.5 PCI DSS v2.0

9.6 PCI DSS v2.0

9.9 PCI DSS v2.0

9.9.1 9.1.3

9.5 9.6

9.9 9.9.1, 12.2
BCR-07.1 If using virtual infrastructure, does your cloud solution include independent hardware restore and recovery capabilities? BCR-07.2 If using virtual infrastructure, do you provide tenants with a capability to restore a Virtual Machine to a previous state in time? BCR-07.3 If using virtual infrastructure, do you allow virtual machine images to be downloaded and ported to a new cloud provider?
BCR-07.4 If using virtual infrastructure, are machine images made available to the customer in a way that would allow the customer to replicate those images in their own off-site storage location?
BCR-07.5 Does your cloud solution include software/provider independent restore and recovery capabilities?
Business Continuity
Management &
Operational Resilience
Equipment Power
Failures
BCR-08 BCR-08.1 Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific Business Impact Assessment
Are security mechanisms and redundancies implemented to protect equipment from utility service outages (e.g., power failures, network disruptions, etc.)?
A3.2.0 (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk
assessment when commercially practicable.

A1.1
A1.2
F.1 F.1.6, F.1.6.1,
F.1.6.2,
F.1.9.2,
F.2.10, F.2.11,
F.2.12
54 (A+) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RS-07 DSS01.04
DSS01.05
DSS04.01
DSS04.02
DSS04.03
312.8 and 312.10 Infra Services >
Facility Security >
Environmental
Risk
Management
provider x Domain 7,
8 6.08. (a)

6.09. (e)

6.09. (f)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-12
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-8 (1)
NIST SP800-53 R3 CP-8 (2)
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-9
NIST SP800-53 R3 PE-10
NIST SP800-53 R3 PE-11
NIST SP800-53 R3 PE-12
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-14
A.9.2.2
A.9.2.3
A 9.2.4
A.11.2.2,
A.11.2.3,
A.11.2.4
Commandment #1
Commandment #2
Commandment #3
CP-8
PE-1
PE-9
PE-10
PE-11
PE-12
PE-13
PE-14

8.1 8.2

8.3 8.4
PA15 SGP
BCR-09.1 Do you provide tenants with ongoing visibility and reporting of your operational Service Level Agreement (SLA) performance?
BCR-09.2 Do you make standards-based information security metrics (CSA, CAMM, etc.) available to your tenants?
BCR-09.3 Do you provide customers with ongoing visibility and reporting of your SLA performance?
Business Continuity
Management &
Operational Resilience
Policy
BCR-10 BCR-10.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training.

Are policies and procedures established and made available for all personnel to adequately support services operations’ roles? S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data,
processing integrity, system security and related
security policies and changes and updates to those
policies are communicated to entity personnel
responsible for implementing them.

CC3.2 G.1.1 45 (B) OP-01 COBIT 4.1 DS13.1 APO01
APO07.01
APO07.03
APO09.03
DSS01.01
SRM > Policies
and Standards >
Operational
Security Baselines
shared x Domain 7,
8 6.03. (c) NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12

8.2.1 Clause 5.1
A 8.1.1
A.8.2.1
A 8.2.2
A.10.1.1
Clause 5.1(h)
A.6.1.1
A.7.2.1
A.7.2.2
A.12.1.1
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
CM-2
CM-3
CM-4
CM-5
CM-6
CM-9
MA-4
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-12
PCI DSS v2.0

12.1 PCI DSS v2.0

12.2 PCI DSS v2.0

12.3 PCI DSS v2.0

12.4 4.3, 10.8,

11.1.2,

12.1 12.2

12.3 12.4

12.5, 12.5.3,

12.6, 12.6.2,

12.10 BCR-11.1 Do you have technical control capabilities to enforce tenant data retention policies?
BCR-11.2 Do you have a documented procedure for responding to requests for tenant data from governments or third parties?
BCR-11.4 Have you implemented backup or redundancy mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements?
BCR-11.5 Do you test your backup or redundancy mechanisms at least annually?
CCC-01.1 Are policies and procedures established for management authorization for development or acquisition of new applications, systems, databases, infrastructure, services, operations and facilities?
CCC-01.2 Is documentation available that describes the installation, configuration and use of products/services/features?
CCC-02.1 Do you have controls in place to ensure that standards of quality are being met for all software development?
CCC-02.2 Do you have controls in place to detect source code security defects for any outsourced software development activities?
Consensus Assessment Answers Notes

4.1.1, 4.2, 4.3

11.2 11.3

6.3.2, 6.6

11.2.1, 11.2.2,

11.2.3, 11.3.1,

11.3.2, 12.1.2.b,

12.8.4 3.1

12.9.1 12.9.3

12.9.4 12.9.6

4.1, 4.1.1, 9.1, 9.2

10.8, 11.6

3.1 3.1.a

3.2 9.9.1

9.5. 9.5.1

9.6. 9.7, 9.8

10.7, 12.10.1

6.3.2, 12.3.4

2.1, 2.2.4, 2.3, 2.5

3.3, 3.4, 3.6

4.1, 4.2

6.3.1, 6.3.2, 6.4.2,

6.4.3, 6.4.4,

6.4.5.2 6.7

7.1, 7.1.3, 7.1.4

8.3, 8.5.1, 8.7

9.1 9.1.2

9.2 10.5

11.5 12.3

12.8 BSGP
SGP
PA17 SGP
ODCA UM: PA R2.0
PA17
PA31
SGP
BSGP
PA18 GP
PA15 SGP
PA8
PA15
BSGP
SGP
PA8
PA15

14.5 14.6

9.2 6.1

1.2 2.2

3.3 5.2

6.4 10.1

10.2 10.3

10.4 10.5

10.6 3.3

12.1 12.5

14.5 (software)

6.4 6.4

13.1 12.1

2.2 4.1
AR-7 The organization
designs information
systems to support
privacy by automating
privacy controls.

AP-1 The organization
determines and
documents the legal
authority that permits the
collection, use,
maintenance, and
sharing of personally
identifiable information
(PII), either generally or
in support of a specific
program or information
system need.

AR-4. Privacy Auditing
and Monitoring. These
assessments can be selfassessments or third
party audits that result in
reports on compliance
gaps identified in
programs, projects, and
information systems.

UL-2 INFORMATION

SHARING WITH THIRD
PARTIES - a. Shares
personally identifiable
information (PII)
externally, only for the
authorized purposes
identified in the Privacy
Act and/or described in its
notice(s) or for a purpose
that is compatible with
those purposes; b. Where
appropriate, enters into
Memoranda of
Understanding,
Memoranda of
Agreement, Letters of
Intent, Computer
Matching Agreements, or
similar agreements, with
third parties that
specifically describe the
PII covered and
specifically enumerate
the purposes for which
the PII may be used; c.

Monitors, audits, and
trains its staff on the
authorized sharing of PII
with third parties and on
the consequences of
unauthorized use or
sharing of PII; and d.

Evaluates any proposed
new instances of sharing
PII with third parties to
assess whether the
sharing is authorized and
whether additional or
new public notice is
required.

FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of
passwords; and the
storage of data on secure
servers or computers . -
http://www.ftc.gov/repo
rts/privacy3/fairinfo.sht
m
ITOS > IT
Operation >
Architecture
Governance
shared x
CSA Enterprise Architecture (formerly the Trusted
Cloud Initiative)
Application
Services >
Development
Process >
Software Quality
Assurance
shared x
BOSS > Legal
Services >
Contracts
shared x
BOSS >
Compliance >
Independent
Audits
shared x
BOSS >
Compliance >
Information
System
Regulatory
Mapping
shared x
BOSS >
Operational Risk
Management >
Business
Continuity
provider x
Infra Services >
Facility Security >
Environmental
Risk
Management
x
312.8 and 312.10
312.3, 312.8 and
312.10
Title 16 Part 312
312.4
312.8 and 312.10
312.3
APO09.03
APO13.01
BAI03.01
BAI03.02
BAI03.03
BAI03.05
MEA03.01
MEA03.02
APO09.01
APO09.02
APO09.03
APO13.01
BAI02
DSS05
APO12.04
APO12.05
DSS05.07
MEA02.06
MEA02.07
MEA02.08
MEA03.01
APO12.01
APO12.02
APO12.03
MEA03.01
DSS04.01
DSS04.02
DSS04.03
DSS04.05
DSS01.03
DSS01.04
DSS01.05
DSS04.03
BAI03.10
BAI04.03
BAI04.04
DSS03.05
BAI06.01
BAI10.01
BAI10.02
BAI10.03
DSS04.01
DSS04.02
BAI09.01
BAI09.02
BAI09.03
DSS04.01
DSS04.02
DSS04.03
DSS04.04
DSS04.07
MEA03.01
APO01.02
APO01.06
BAI02.04
BAI06.01
APO07.06
APO09.03
APO09.04
APO10.01
APO10.04
APO10.05
APO11.01
APO11.02
APO11.04
APO11.05
CC5.1
CC4.1
CC3.1
CC3.1
A1.2
A1.3
A1.1
A1.2
A1.3
A1.1
A1.2
CC4.1
CC3.1
A1.2
A1.3
A1.2
A1.3
I3.21
CC7.2
CC7.1
CC7.4
CC7.1
CC7.4
ITOS > IT
Operation >
Architecture
Governance
shared PCI DSS v2.0

6.3.2 Change Control &
Configuration
Management
Outsourced
Development
CCC-02 External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g. ITIL service management processes).

S3.10.0
S3.13
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system availability, confidentiality of data,
processing integrity, systems security and related
security policies.
(S3.13) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.

C.2
I.1
I.2
I.4
C.2.4, G.4, G6,
I.1, I.4.4, I.4.5,
I.2.7.2, I.2.8,
I.2.9, I.2.15,
I.2.18,
I.2.22.6,
I.2.7.1, I.2.13,
I.2.14, I.2.17,
I.2.20,
I.2.22.2,
I.2.22.4,
I.2.22.7,
I.2.22.8,
I.2.22.9,
I.2.22.10,
I.2.22.11,
I.2.22.12,
I.2.22.13,
I.2.22.14, I.3,
J.1.2.10, L.7,
L.9, L.10
27 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-04 None NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12
1 (B)
Commandment #1
Commandment #2
Commandment #3
SA-4
SA-5
SA-8
SA-9
SA-10
SA-11
SA-12
SA-13
PCI DSS v2.0

3.6.7 PCI DSS v2.0

6.4.5.2 PCI DSS v2.0

7.1.3 PCI DSS v2.0

8.5.1 PCI DSS v2.0

9.1 PCI DSS v2.0

9.1.2 PCI DSS v2.0

9.2b
PCI DSS v2.0

9.3.1 PCI DSS v2.0

10.5.2 PCI DSS v2.0

11.5 PCI DSS v2.0

12.3.1 PCI DSS v2.0

12.3.3 Chapter II
Article 11, 13
CIP-003-3 -
R4.1
CP-2
CP-6
CP-7
CP-8
CP-9
SI-12
AU-11
PCI DSS v2.0

3.1 PCI DSS v2.0

3.1.1 PCI DSS v2.0

3.2 PCI DSS v2.0

9.9.1 PCI DSS v2.0

9.5 PCI DSS v2.0

9.6 PCI DSS v2.0

10.7 Change Control &
Configuration
Management
New Development /
Acquisition
CCC-01 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or datacenter facilities have been preauthorized by the organization's business leadership or other accountable business role or function.

S3.12.0
S3.10.0
S3.13.0
(S3.12.0) Procedures exist to maintain system
components, including configurations consistent
with the defined system security policies.
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system security policies.
(S3.13.0) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.

I.2 I.1.1, I.1.2, I.2.

7.2, I.2.8,
I.2.9, I.2.10,
I.2.13, I.2.14,
I.2.15, I.2.18,
I.2.22.6, L.5
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-01 COBIT 4.1 A12, A

16.1 None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)

1.2.6 BOSS > Data
Governance >
Data Retention
Rules
Business Continuity shared x
Management &
Operational Resilience
Retention Policy
BCR-11 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness.

A3.3.0
A3.4.0
I3.20.0
I3.21.0
(A3.3.0) Procedures exist to provide for backup,
offsite storage, restoration, and disaster recovery
consistent with the entity’s defined system
availability and related security policies.
(A3.4.0) Procedures exist to provide for the
integrity of backup data and systems maintained
to support the entity’s defined system availability
and related security policies.
(I3.20.0) Procedures exist to provide for
restoration and disaster recovery consistent with
the entity’s defined processing integrity policies.
(I3.21.0) Procedures exist to provide for the
completeness, accuracy, and timeliness of backup
data and systems.

D.2.2.9 36 (B) Schedule 1
(Section 5) 4.5 -
Limiting Use,
Disclosure and
Retention, Subsec.

4.5.2 DG-04 COBIT 4.1 DS 4.1,
DS 4.2, DS 4.5,
DS 4.9, DS 11.6
Domain 5 6.03. (h)

6.07.01. (c)
Article 6(1) e NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-2 (1)
NIST SP 800-53 R3 CP-2 (2)
NIST SP 800-53 R3 CP-6
NIST SP 800-53 R3 CP-6 (1)
NIST SP 800-53 R3 CP-6 (3)
NIST SP 800-53 R3 CP-7
NIST SP 800-53 R3 CP-7 (1)
NIST SP 800-53 R3 CP-7 (2)
NIST SP 800-53 R3 CP-7 (3)
NIST SP 800-53 R3 CP-7 (5)
NIST SP 800-53 R3 CP-8
NIST SP 800-53 R3 CP-8 (1)
NIST SP 800-53 R3 CP-8 (2)
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3)

5.1.0 5.1.1

5.2.2 8.2.6
CIP-007-3 -
R6.1 -
R6.2 -
R6.3 -
R6.4
MA-2
MA-3
MA-4
MA-5
MA-6
A11.2.4
A.17.1.1
A.17.1.2
Clauses

9.2(g)

7.5.3(b)

5.2 (c)

7.5.3(d)

5.3(a)

5.3(b)

8.1 8.3
A.12.3.1
A.8.2.3
Commandment #1
Commandment #2
Commandment #3
CA-1
CM-1
CM-9
PL-1
PL-2
SA-1
SA-3
SA-4
45 CFR 164.308
(a)(7)(ii)(E)

ISO/IEC
27001:2005
A.14.1.2
A 14.1.4
Commandment #1
Commandment #2
Commandment #3
CIP-007-3 -
R8 - R8.1 -
R8.2 -
R8.3
RA-3
A.6.1.4
A.6.2.1
A.12.1.1
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.5
A.15.1.3
A.15.1.4
45 CFR 164.308
(a)(7)(ii)(A)
45 CFR 164.310
(d)(2)(iv)
45 CFR
164.308(a)(7)(ii)
(D) (New)
45 CFR
164.316(b)(2)(i)
(New)
Clause 4.3.3
A.10.5.1
A.10.7.3
EAR 15 §
762.6
Period of
Retention
EAR 15
CFR §
786.2
Recordke
eping
Commandment
#11
Commandment #2
Commandment #5
Commandment
#11
45 CFR 164.310
(a)(2)(iv)
A.9.2.4
BSGP
SGP
PA10
PA29
COBIT 4.1 A13.3 Domain 7,
8 6.09. (h) Article 17 (1) NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 MA-3
NIST SP 800-53 R3 MA-3 (1)
NIST SP 800-53 R3 MA-3 (2)
NIST SP 800-53 R3 MA-3 (3)
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 MA-6

5.2.3 8.2.2

8.2.3 8.2.4

8.2.5 8.2.6

8.2.7 Business Continuity
Management &
Operational Resilience
Impact Analysis
BCR-09 There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following:
• Identify critical products and services
• Identify all dependencies, including processes, applications, business partners, and third party service providers
• Understand threats to critical products and services
• Determine impacts resulting from planned or unplanned disruptions and how these vary over time
• Establish the maximum tolerable period for disruption • Establish priorities for recovery
• Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption
• Estimate the resources required for resumption
A3.1.0
A3.3.0
A3.4.0
(A3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system availability commitments
and (2) assess the risks associated with the
identified threats.
(A3.3.0) Procedures exist to provide for backup,
offsite storage, restoration, and disaster recovery
consistent with the entity’s defined system
availability and related security policies.
(A3.4.0) Procedures exist to provide for the
integrity of backup data and systems maintained
to support the entity’s defined system availability
and related security policies.

K.2 RS-02 Domain 7,
8 6.02. (a)

6.03.03. (c)

6.07. (a)

6.07. (b)

6.07. (c)
Article 17 (1), (2) NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3
Infra Services >
Equipment
Maintenance >
provider x
ITOS > Service
Delivery >
Information
Technology
Resiliency -
Resiliency
Analysis
A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.
(A4.1.0) The entity’s system availability and
security performance is periodically reviewed and
compared with the defined system availability and
related security policies.

F.2.19
PCI DSS v2.0

3.1.1 PCI DSS v2.0

3.1 45 CFR 164.308
(a)(7)(i)
45 CFR 164.308
(a)(7)(ii)(B)
45 CFR 164.308
(a)(7)(ii)(C)
45 CFR 164.308
(a)(7)(ii)(E)
45 CFR 164.310
(a)(2)(i)
45 CFR 164.312
(a)(2)(ii)
Clause 5.1
A.6.1.2
A.14.1.3
A.14.1.4
Commandment #1
Commandment #2
Commandment #3

ISO/IEC
27001:2005
Clause 4.2.1 b)
2)
Clause 4.2.1 c)
1)
Clause 4.2.1 g)
Clause 4.2.3 d)
6)
Clause 4.3.3
Clause 5.2.1 a - f
Clause 7.3 c) 4)
A.7.2.1
A.15.1.1
A.15.1.3
A.15.1.4
A.15.1.6
Clauses

4.2(b),

4.4,

5.2(c),

5.3(ab),

6.1.2,

6.1.3,

6.1.3(b),

7.5.3(b),

7.5.3(d),

8.1,

8.3 9.2(g),

9.3,

9.3(b),

9.3(f),

10.2,
A.8.2.1,
Clause 5.1(h)
A.17.1.2
A.17.1.2
A11.2.2,
A11.2.3
CP-1
CP-2
CP-3
CP-4
CP-6
CP-7
CP-8
CP-9
CP-10
PE-17
PCI DSS v2.0

12.9.1 PCI DSS v2.0

12.9.3 PCI DSS v2.0

12.9.4 PCI DSS v2.0

12.9.6 PE-1
PE-4
PE-13
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #9
Commandment
#11
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
Business Continuity
Management &
Operational Resilience
Power /
Telecommunications
BCR-03 Datacenter utilities services and environmental conditions (e.g., water, power, temperature and humidity controls,
telecommunications,and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions.

A3.2.0
A3.4.0
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.
(A3.4.0) Procedures exist to protect against
unauthorized access to system resource.

F.1 F.1.6, F.1.6.1,
F.1.6.2,
F.1.9.2,
F.2.10, F.2.11,
F.2.12
9 (B)
10 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RS-08 Domain 7,
8 6.08. (a)

6.09. (c)

6.09. (f)

6.09. (g)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13
(1)
NIST SP800-53 R3 PE-13
(2)
NIST SP800-53 R3 PE-13
(3)
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-4
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
provider x
COBIT 4.1 ME 3.1 Domain 2,
4 1.2.5

1.2.7 4.2.1

8.2.7 10.2.3

10.2.5 6.03.01. (c) Article: 27 (3) NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-4
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-10
NIST SP 800-53 R3 SC-11
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SC-17
NIST SP 800-53 R3 SC-18

1.2.6 Audit Assurance &
Compliance
Independent Audits
Domain 10
Business Continuity
Management &
Operational Resilience
Business Continuity
Planning
BCR-01 A consistent unified framework for business continuity planning and plan development shall be established, documented and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following:
• Defined purpose and scope, aligned with relevant dependencies • Accessible to and understood by those who will use them • Owned by a named person(s) who is responsible for their review, update, and approval
• Defined lines of communication, roles, and responsibilities • Detailed recovery procedures, manual work-around, and reference information
• Method for plan invocation
A3.1.0
A3.3.0
A3.4.0
(A3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system availability commitments
and (2) assess the risks associated with the
identified threats.
(A3.3.0) Procedures exist to provide for backup,
offsite storage, restoration, and disaster recovery
consistent with the entity’s defined system
availability and related security policies.
(A3.4.0) Procedures exist to provide for the
integrity of backup data and systems maintained
to support the entity’s defined system availability
and related security policies.

K.1.2.3.

K.1.2.4,
K.1.2.5,
K.1.2.6,
K.1.2.7,
K.1.2.11,
K.1.2.13,
K.1.2.15
RS-03 Domain 7,
8 6.07. (a)

6.07. (b)

6.07. (c)
Article 17 (1), (2) NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-2 (1)
NIST SP800-53 R3 CP-2 (2)
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-4 (1)
NIST SP800-53 R3 CP-6
NIST SP800-53 R3 CP-6 (1)
NIST SP800-53 R3 CP-6 (3)
NIST SP800-53 R3 CP-7
NIST SP800-53 R3 CP-7 (1)
NIST SP800-53 R3 CP-7 (2)
NIST SP800-53 R3 CP-7 (3)
NIST SP800-53 R3 CP-7 (5)
NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-8 (1)
NIST SP800-53 R3 CP-8 (2)
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-9 (1)
NIST SP800-53 R3 CP-9 (3)
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 CP-10 (2)
NIST SP800-53 R3 CP-10 (3)
NIST SP800-53 R3 PE-17
AAC02Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures and compliance obligations.

S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically
reviewed and compared with the defined system
security policies.
(S4.2.0) There is a process to identify and address
potential impairments to the entity’s ongoing
ability to achieve its objectives in accordance with
its defined system security policies.

L.2, L.4, L.7,
L.9, L.11
58 (B)
59 (B)
61 (C+,
A+)
76 (B)
77 (B)
CC7.1 COBIT 4.1 AI2.4
CCM v3.0.1 Compliance Mapping
45 CFR 6, 6.5
164.312(e)(2)(i)
A.11.5.6
A.11.6.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.5.2
A.12.5.4
A.12.5.5
A.12.6.1
A.15.2.1
Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment
#11
CIP-007-3 -
R5.1
SC-2
SC-3
SC-4
SC-5
SC-6
SC-7
SC-8
SC-9
SC-10
SC-11
SC-12
SC-13
SC-14
SC-17
SC-18
SC-20
SC-21
SC-22
SC-23
PCI DSS v2.0

6.5 Application & Interface
Security
Customer Access
Requirements
AIS-02 Prior to granting customers access to data, assets, and information systems, (removed all) identified security, contractual, and regulatory requirements for customer access shall be addressed.

Commandment #1
Commandment #2
Commandment #3
Chapter VI, Section 1
Article 39, I. and VIII.

Chapter 8
Article 59
CIP-003-3 -
R1.3 -
R4.3
CIP-004-3
R4 - R4.2
CIP-005-
3a - R1 -
R1.1 -
R1.2
CA-1
CA-2
CA-6
RA-5
PCI DSS v2.0

11.2 PCI DSS v2.0

11.3 PCI DSS v2.0

6.6 PCI DSS v2.0

12.1.2.b
COBIT 4.1 DS5.5,
ME2.5, ME 3.1
PO 9.6
Domain 2,
4 6.03. (e)

6.07.01. (m)

6.07.01. (n)
A9.4.2
A9.4.1,

8.1*Partial,
A14.2.3,

8.1*partial,
A.14.2.7
A12.6.1,
A18.2.2
A9.1.1.

Clauses

4.3(a),

4.3(b),

5.1(e),

5.1(f),

9.1,

9.2,

9.3(f),
A18.2.1
Schedule 1 SA-01
(Section 5) 4.1
Accountability,
Subs. 4.1.3
Control Group CGID CID Control Specification Consensus Assessment Questions Application & Interface
Security
Application Security
AIS-01 Applications and programming interfaces (APIs) shall be designed, developed, deployed and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.

S3.10.0 (S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system security policies to enable
authorized access and to prevent unauthorized
access.
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined processing integrity and related security
policies.

I.4 G.16.3, I.3 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-04
C.2.1, C.2.3,
C.2.4, C.2.6.1,
H.1
10 (B)
11 (A+)
(S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.

CO-02
Audit Assurance &
Compliance
Information System
Regulatory Mapping
AAC03Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected.

Business Continuity
Management &
Operational Resilience
Equipment
Maintenance
BCR-07 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel.

OP-04

CONSENSUS ASSESSMENTS INITIATIVE
QUESTIONNAIRE v3.0.1
Commandment #6
Commandment #7
Commandment #8
CA-1
CA-2
CA-5
CA-6
A.6.2.1
A.6.2.2
A.11.1.1

1.2.2 1.2.6

6.2.1 6.2.2
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
Domain 10 Article 17 (1), (2)
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)
S3.2a
45 CFR 164.308
(a)(8)
45 CFR
164.308(a)(1)(ii)
(D)
Clause 4.2.3e
Clause 5.1 g
Clause 5.2.1 d)
Clause 6
A.6.1.8
provider x
A.9.2.2
A.9.2.3
A.6.1.8
A.6.2.1
A.6.2.3
A.10.1.4
A.10.2.1
A.10.2.2
A.10.2.3
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.5.5
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* (partial)
A.14.2.7
A.18.1.3
A.18.1.4
A18.2.1
A.15.1.2
A.12.1.4

8.1* (partial)

8.1* (partial)
A.15.2.1

8.1* (partial)
A.15.2.2
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* (partial)
A.14.2.2

8.1* (partial)
A.14.2.3

8.1* (partial)
A.14.2.4

8.1* (partial)
A.14.2.7
A.12.6.1
A.16.13
A.18.2.2
A.18.2.3
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 84
#2..
- 128 -
CCC-03.1 Do you provide your tenants with documentation that describes your quality assurance process?
CCC-03.2 Is documentation describing known issues with certain products/services available?
CCC-03.3 Are there policies and procedures in place to triage and remedy reported bugs and security vulnerabilities for product and service offerings?
CCC-03.4 Are mechanisms in place to ensure that all debugging and test code elements are removed from released software versions?
Change Control &
Configuration
Management
Unauthorized Software
Installations
CCC-04 CCC-04.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems?
A3.6.0
S3.5.0
S3.13.0
(A3.6.0) Procedures exist to restrict physical access
to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
(S3.5.0) Procedures exist to protect against
infection by computer viruses, malicious code, and
unauthorized software.
(S3.13.0) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.

CC5.5
CC5.8
CC7.4
G.1
I.2
G.2.13,
G.20.2,G.20.4,
G.20.5, G.7,
G.7.1, G.12.11,
H.2.16,
I.2.22.1,
I.2.22.3,
I.2.22.6, I.2.23
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-05 APO13.01
BAI06.01
BAI10
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03
312.8 and 312.10 ITOS > Service
Support >
Configuration
Management ->
Software
Mangement
shared x None NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)

3.2.4 8.2.2
A.10.1.3
A.10.4.1
A.11.5.4
A.11.6.1
A.12.4.1
A.12.5.3
A.6.1.2
A.12.2.1
A.9.4.4
A.9.4.1
A.12.5.1

8.1* (partial)
A.14.2.4
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment
#11
CM-1
CM-2
CM-3
CM-5
CM-7
CM-8
CM-9
SA-6
SA-7
SI-1
SI-3
SI-4
SI-7
FTC Fair Information
Principles
Involves both managerial
and technical measures
to protect against loss
and the unauthorized
access, destruction, use,
or disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

14.1 1.3.3

2.1, 2.2.2

3.6 4.1

5.1, 5.2, 5.3, 5.4

6.2 7.1

9.1 9.1.1

9.1.2 9.1.3

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3

10.1, 10.2, 10.3,

10.4, 10.5, 10.6,

10.7 11.1, 11.4, 11.5

12.3 Change Control &
Configuration
Management
Production Changes
CCC-05 CCC-05.1 Policies and procedures shall be established for managing the risks associated with applying changes to business-critical or customer (tenant) impacting (physical and virtual) application and systemsystem interface (API) designs and configurations, as well as infrastructure network and systems components. Technical measures shall be implemented to provide assurance that, prior to deployment, all changes directly correspond to a registered change request, business-critical or customer (tenant) , and/or authorization by, the customer (tenant) as per agreement (SLA).

Do you provide tenants with documentation that describes your production change management procedures and their
roles/rights/responsibilities within it?
A3.16.0
S3.13.0
(A3.16.0, S3.13.0) Procedures exist to provide that
only authorized, tested, and documented changes
are made to the system.

CC7.4
CC7.4
I.2.17, I.2.20,
I.2.22
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-02 COBIT 4.1 A16.1,
A17.6
BAI06.01
BAI06.02
BAI06.03
BAI06.04
BAI07.01
BAI07.03
BAI07.04
BAI07.05
BAI07.06
ITOS > Service
Support > Release
Management
shared x None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)

1.2.6 45 CFR 164.308
(a)(5)(ii)(C)
45 CFR 164.312
(b)
A.10.1.4
A.12.5.1
A.12.5.2
A.12.1.4

8.1* (partial)
A.14.2.2

8.1* (partial)
A.14.2.3
Commandment #1
Commandment #2
Commandment #3
Commandment
#11
CIP-003-3 -
R6
CA-1
CA-6
CA-7
CM-2
CM-3
CM-5
CM-6
CM-9
PL-2
PL-5
SI-2
SI-6
SI-7
AR- 4. Privacy Monitoring
and Auditing.

Organizations also: (i)
implement technology to
audit for the security,
appropriate use, and loss
of PII; (ii) perform
reviews to ensure
physical security of
documents containing
PII; (iii) assess contractor
compliance with privacy
requirements; and (iv)
ensure that corrective
actions identified as part
of the assessment
process are tracked and
monitored until audit
findings are corrected.

The organization Senior
Agency Official for
Privacy (SAOP)/Chief
Privacy Officer (CPO)
coordinates monitoring
and auditing efforts with
information security

12.1 12.4
PA14 SGP PCI DSS v2.0

1.1.1 PCI DSS v2.0

6.3.2 PCI DSS v2.0

6.4 PCI DSS v2.0

6.1 1.1.1

6.3.2 6.4.5
DSI-01.1 Do you provide a capability to identify virtual machines via policy tags/metadata (e.g., tags can be used to limit guest operating systems from booting/instantiating/transporting data in the wrong country)?
DSI-01.2 Do you provide a capability to identify hardware via policy tags/metadata/hardware tags (e.g., TXT/TPM, VN-Tag, etc.)? DSI-01.3 Do you have a capability to use system geographic location as an authentication factor?
DSI-01.4 Can you provide the physical location/geography of storage of a tenant’s data upon request?
DSI-01.5 Can you provide the physical location/geography of storage of a tenant's data in advance?
DSI-01.6 Do you follow a structured data-labeling standard (e.g., ISO 15489, Oasis XML Catalog Specification, CSA data type guidance)? DSI-01.7 Do you allow tenants to define acceptable geographical locations for data routing or resource instantiation?
DSI-02.1 Do you inventory, document, and maintain data flows for data that is resident (permanent or temporary) within the services' applications and infrastructure network and systems?
DSI-02.2 Can you ensure that data does not migrate beyond a defined geographical residency?
DSI-03.1 Do you provide open encryption methodologies (3.4ES, AES, etc.) to tenants in order for them to protect their data if it is required to move through public networks (e.g., the Internet)?
DSI-03.2 Do you utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another)?
DSI-04.1 Are policies and procedures established for labeling, handling and the security of data and objects that contain data?
DSI-04.2 Are mechanisms for label inheritance implemented for objects that act as aggregate containers for data?
Data Security &
Information Lifecycle
Management
Nonproduction Data
DSI-05 DSI-05.1 Production data shall not be replicated or used in non-production environments.

Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments?
C3.5.0
S3.4.0
C3.21.0
(C3.5.0) The system procedures provide that
confidential information is disclosed to parties only
in accordance with the entity’s defined
confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against
unauthorized access to system resources.
(C3.21.0) Procedures exist to provide that
confidential information is protected during the
system development, testing, and change
processes in accordance with defined system
confidentiality and related security policies.

C1.3
CC5.6
C1.1
I.2.18 DG-06 APO01.06
BAI01.01
BAI03.07
BAI07.04
SRM > Policies
and Standards >
Technical
Standard (Data
Management
Security
Standard)
shared x Domain 5 6.03. (d) NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)

1.2.6 45 CFR
164.308(a)(4)(ii)
(B)
A.7.1.3
A.10.1.4
A.12.4.2
A.12.5.1
A.8.1.3
A.12.1.4
A.14.3.1

8.1* (partial)
A.14.2.2.

Commandment #9
Commandment
#10
Commandment
#11
CIP-003-3 -
R6
SA-11
CM-04
DM-1 Minimization of
Personally Identifiable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII
used in Testing, Training,
and Research. SE-1

INVENTORY OF

PERSONALLY

IDENTIFIABLE

INFORMATION

17.8 PCI DSS v2.0

6.4.3 6.4.3
Data Security &
Information Lifecycle
Management
Ownership /
Stewardship
DSI-06 DSI-06.1 All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.

Are the responsibilities regarding data stewardship defined, assigned, documented and communicated?
S2.2.0
S2.3.0
S3.8.0
(S2.2.0) The security obligations of users and the
entity’s security commitments to users are
communicated to authorized users.
(S2.3.0) Responsibility and accountability for the
entity’s system security policies and changes and
updates to those policies are communicated to
entity personnel responsible for implementing
them.
(S3.8.0) Procedures exist to classify data in
accordance with classification policies and
periodically monitor and update such
classifications as necessary
CC2.3
CC3.1
C.2.5.1,
C.2.5.2, D.1.3,
L.7
Schedule 1
(Section 5) 4.5 -
Limiting Use,
Disclosure and
Retention, Subsec.

4.1.3 DG-01 COBIT 4.1 DS5.1,
PO 2.3
APO01.06
APO03.02
APO13.01
APO13.03
312.4 BOSS > Data
Governance >
Data Ownership /
Stewardship
shared x Domain 5 Article 4 NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2
(1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2

6.2.1 45 CFR 164.308
(a)(2)
A.6.1.3
A.7.1.2
A.15.1.4
A.6.1.1
A.8.1.2
A.18.1.4
Commandment #6
Commandment
#10
Chapter IV
Article 30
CIP-007-3 -
R1.1 -
R1.2
CA-2
PM-5
PS-2
RA-2
SA-2
AP-1 AUTHORITY TO
COLLECT. AP-2 PURPOSE
SPECIFICATION.

3.4 3.7

12.5.5 12.10.4
DSI-07.1 Do you support secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data as determined by the tenant?
DSI-07.2 Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource?
DCS-01.1 Do you maintain a complete inventory of all of your critical assets that includes ownership of the asset?
DCS-01.2 Do you maintain a complete inventory of all of your critical supplier relationships?
Datacenter Security
Controlled Access
Points
DCS02DCS-02.1 Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.

Are physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks and security patrols) implemented? A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

12.3 APO13.01
DSS01.01
DSS01.05
DSS05.05
DSS06.03
DSS06.06
312.8 and 312.10 Infra Services >
Facility Security >
Controlled
Physical Access
provider x Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-8
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-8
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 A.9.1.1 A.11.1.1
A.11.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #5
CIP-006-
3c R1.2 -
R1.3 -
R1.4 -
R1.6 -
R1.6.1 -
R2 - R2.2
PE-2
PE-3
PE-6
PE-7
PE-8
PE-18

8.1 8.2
PA4 BSGP PCI DSS v2.0

9.1 9.1

9.1.1 9.1.2, 9.1.3

9.2, 9.3, 9.4, 9.4.1,

9.4.2, 9.4.3, 9.4.4
Datacenter Security
Equipment
Identification
DCS03DCS-03.1 Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location.

Is automated equipment identification used as a method to validate connection authentication integrity based on known equipment location?
S3.2.a (S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.

CC5.1 D.1 D.1.1, D.1.3 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-13 COBIT 4.1 DS5.7 APO13.01
DSS05.02
DSS05.03
312.3, 312.8 and
312.10
> > Domain 8 6.05. (a) NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-3 NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
A.11.4.3 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #8
IA-3
IA-4
PA22
PA33
GP
SGP
Datacenter Security
Offsite Authorization
DCS04DCS-04.1 Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.

Do you provide tenants with documentation that describes scenarios in which data may be moved from one physical location to another? (e.g., offsite backups, business continuity failovers, replication) S3.2.f
C3.9.0
(S3.2.f) f. Restriction of access to offline storage,
backup data, systems, and media.
(C3.9.0) Procedures exist to restrict physical access
to the defined system including, but not limited to:
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

CC5.1
CC5.5
F.2.18, F.2.19, Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.5
FS-06 EDM05.02
APO01.02
APO03.02
BAI02.03
BAI02.04
BAI03.09
BAI06.01
312.8 and 312.10 SRM > Facility
Security > Asset
Handling
provider x Domain 8 6.08. (a)

6.09. (j)
Article 17 NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-17
45 CFR 164.310
(d)(1) (New)
A.9.2.7
A.10.1.2
A.11.2.6
A.11.2.7
Commandment #4
Commandment #5
Commandment
#11
AC-17
MA-1
PE-1
PE-16
PE-17

12.5 19.1
PA4 BSGP PCI DSS v2.0

9.8 PCI DSS v2.0

9.9 9.6.3
Datacenter Security
Offsite equipment
DCS05DCS-05.1 Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premise. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full write of the drive to ensure that the erased drive is released to inventory for reuse and deployment or securely stored until it can be destroyed.

Can you provide tenants with evidence documenting your policies and procedures governing asset management and repurposing of equipment?
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

CC5.6 D.1 D.1.1, D.2.1.

D.2.2,
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.5
FS-07 APO09.03
APO10.04
APO10.05
APO13.01
DSS01.02
312.8 and 312.10 BOSS > Data
Governance >
Secure Disposal
of Data
provider x Domain 8 6.05. (a)

6.05. (b)

6.05. (c)
Article 17 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 SC-30
45 CFR 164.310
(c )
45 CFR 164.310
(d)(1) (New)
45 CFR 164.310
(d)(2)(i) (New)
A.9.2.5
A.9.2.6
A.8.1.1
A.8.1.2
Commandment #6
Commandment #7
Commandment #8
CM-8 12.6 PA4 BSGP PCI DSS v2.0

9.8 PCI DSS v2.0

9.9 PCI DSS v2.0

9.10 9.8, 9.8.1, 9.8.2

12.3 DCS-06.1 Can you provide evidence that policies, standards and procedures have been established for maintaining a safe and secure working environment in offices, rooms, facilities and secure areas? DCS-06.2 Can you provide evidence that your personnel and involved third parties have been trained regarding your documented policies, standards and procedures?
Datacenter Security
Secure Area
Authorization
DCS07DCS-07.1 Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.

Do you allow tenants to specify which of your geographic locations their data is allowed to move into/out of (to address legal jurisdictional considerations based on where data is stored vs. accessed)?
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

CC5.5 F.2 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
7 (B) Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-04 DS 12.2, DS 12.3 APO13.01
APO13.02
DSS05.05
312.8 and 312.10 SRM > Policies
and Standards >
Information
Security Policy
(Facility Security
Policy)
provider x Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 A.9.1.1
A.9.1.2
A.11.1.6 Commandment #1
Commandment #2
Commandment #3
Commandment #5
CIP-006-
3c R1.2 -
R1.3 -
R1.4
PE-7
PE-16
PE-18

8.2 8.1
PA4 BSGP PCI DSS v2.0

9.1 PCI DSS v2.0

9.1.1 PCI DSS v2.0

9.1.2 PCI DSS v2.0

9.1.3 PCI DSS v2.0

9.2 9.1

9.1.1 9.1.3
Datacenter Security
Unauthorized Persons
Entry
DCS08DCS-08.1 Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.

Are ingress and egress points, such as service areas and other points where unauthorized personnel may enter the premises, monitored, controlled and isolated from data storage and process?
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

CC5.5 G.21 F.2.18 Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-05 COBIT 4.1 DS

12.3 APO13.01
APO13.02
DSS05.05
DSS06.03
312.8 and 312.10 SRM > Policies
and Standards >
Information
Security Policy
(Facility Security
Policy)
provider x Domain 8 6.08. (a)

6.09. (j)
Article 17 NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 PE-16

99.31.a.1.ii 8.2.5

8.2.6 A.9.1.6 A.11.2.5

8.1* (partial)
A.12.1.2
Commandment #6
Commandment #7
MA-1
MA-2
PE-16

8.1 8.2

8.3 8.4
PA4 BSGP 9.1

9.1.1 9.1.2

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3 Datacenter Security
User Access
DCS09DCS-09.1 Physical access to information assets and functions by users and support personnel shall be restricted.

Do you restrict physical access to information assets and functions by users and support personnel?
A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

CC5.5 F.2 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
7 (B)
10 (B)
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-02 APO13.01
APO13.02
DSS05.04
DSS05.05
DSS06.03
312.8 and 312.10 Infra Services >
Facility Security >
Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 45 CFR
164.310(a)(1)
(New)
45 CFR
164.310(a)(2)(ii)
(New)
45 CFR
164.310(b)
(New)
45 CFR 164.310
( c) (New)
A.9.1.1
A.9.1.2
A.11.1.1 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Chapter II,
Article 19
CIP-006-
3c R1.2 -
R1.3 -
R1.4 -
R1.6 -
R1.6.1 -
R2 - R2.2
PE-2
PE-3
PE-6
PE-18

8.1 8.2
PA4
PA13
PA24
BSGP
SGP
P
PCI DSS v2.0

9.1 9.1

9.1.1 9.1.2

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3

9.4.4 9.5

9.5.1 Encryption & Key
Management
Entitlement
EKM01EKM-01.1 Keys must have identifiable owners (binding keys to identities) and there shall be key management policies.

Do you have key management policies binding keys to identifiable owners?
APO01.06
APO13.01
DSS05.04
DSS05.06
DSS06.03
SRM >
Cryptographic
Services > Key
Management
Annex
A.10.1
A.10.1.1
A.10.1.2
PA36 3.5, 7.1.3

8.1 8.1.1

8.2.2 EKM-02.1 Do you have a capability to allow creation of unique encryption keys 8.5 per tenant?
EKM-02.2 Do you have a capability to manage encryption keys on behalf of tenants?
EKM-02.3 Do you maintain key management procedures?
EKM-02.4 Do you have documented ownership for each stage of the lifecycle of encryption keys?
EKM-02.5 Do you utilize any third party/open source/proprietary frameworks to manage encryption keys?
EKM-03.1 Do you encrypt tenant data at rest (on disk/storage) within your environment?
EKM-03.2 Do you leverage encryption to protect data and virtual machine images during transport across and between networks and hypervisor instances?
EKM-03.3 Do you support tenant-generated encryption keys or permit tenants to encrypt data to an identity without access to a public key certificate (e.g. identity-based encryption)?
EKM-03.4 Do you have documentation establishing and defining your encryption management policies, procedures and guidelines? EKM-04.1 Do you have platform and data appropriate encryption that uses open/validated formats and standard algorithms?
EKM-04.2 Are your encryption keys maintained by the cloud consumer or a trusted key management provider?
EKM-04.3 Do you store encryption keys in the cloud?
EKM-04.4 Do you have separate key management and key usage duties? GRM01.1Do you have documented information security baselines for every component of your infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.)?
GRM01.2Do you have a capability to continuously monitor and report the compliance of your infrastructure against your information security baselines?
GRM01.3Do you allow your clients to provide their own trusted virtual machine image to ensure conformance to their own internal standards?
GRM02.1Do you provide security control health data in order to allow tenants to implement industry standard Continuous Monitoring (which allows continual tenant validation of your physical and logical control status)?
GRM02.2Do you conduct risk assessments associated with data governance requirements at least once a year?
Governance and Risk
Management
Management
Oversight
GRM03GRM03.1Managers are responsible for maintaining awareness of, and complying with, security policies, procedures and standards that are relevant to their area of responsibility.

Are your technical, business, and executive managers responsible for maintaining awareness of and compliance with security policies, procedures, and standards for both themselves and their employees as they pertain to the manager and employees' area of
responsibility?
S1.2.f
S2.3.0
(S1.2.f) f. Assigning responsibility and
accountability for system availability,
confidentiality, processing integrity and related
security.
(S2.3.0) Responsibility and accountability for the
entity’s system security policies and changes and
updates to those policies are communicated to
entity personnel responsible for implementing
them.

CC3.2
E.1 E.4 5 (B)
65 (B)
Schedule 1
(Section 5) 4.1
Accountability; 4.7
Safeguards, Sub

4.7.4 IS-14 COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
COBIT 4.1 DS5.5
APO01.03
APO01.04
APO01.08
DSS01.01
312.8 and 312.10 BOSS > Human
Resources
Security > Roles
and
Responsibilities
shared x Domain 3,
9 NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)

1.1.2 8.2.1
Clause 5.2.2
A.8.2.1
A.8.2.2
A 11.2.4
A.15.2.1
Clause 7.2(a,b)
A.7.2.1
A.7.2.2
A.9.2.5
A.18.2.2
Commandment #6
Commandment #7
Commandment #8
AT-2
AT-3
CA-1
CA-5
CA-6
CA-7
PM-10
AR-1 Governance and
Privacy Program

3.2 PCI DSS v2.0

12.6.1 PCI DSS v2.0

12.6.2 12.6, 7.3, 8.8, 9.10

6.1 6.2

6.3 6.4

6.5 6.6

6.7 3.1

9.6.1, 9.7.1

9.10 12.3

1.1.3 12.3.3

2.1.1 3.1

4.1 4.1.1

4.2 9.5, 9.5.1

9.6 9.7

9.8 9.9

3.1.1 9.8, 9.8.1, 9.8.2,

3.1 9.7.1

9.9 9.9.1

9.1 9.1.1

9.1.2 9.2

9.3 9.4

9.4.1 9.4.2

9.4.3 9.4.4

3.4.1 3.5

3.5.1 3.5.2

3.6 3.6.1

3.6.2 3.6.3

3.6.4 3.6.5

3.6.6 3.6.7

3.6.8,

4.1 6.5.3

8.2.1 8.2.2

2.1.1 2.3

3.3 3.4

3.4.1 4.1

4.1.1 4.2

4.3 6.5.3

6.5.4 8.2.1

3.5.2, 3.5.3

3.6.1, 3.6.3

1.1 1.1.1

1.1.2 1.1.3

1.1.4 1.1.5

1.1.6 2.2

2.2.1 2.2.2

2.2.3 2.2.4

12.2 PA4
PA8
PA37
PA38
BSGP
BSGP
SGP
SGP
PA4 BSGP
PA36
PA25 GP
PA10
PA18
BSGP
GP
PA10 SGP
PA25
PA21
PA5
GP
GP
BSGP
PA10
PA39
PA34
PA40
BSGP
SGP
SGP
SGP

12.1 14.1

14.2 13.1

13.4 13.5

12.3 4.2

8.1 16.2

16.1 4.4

5.1 3.3

4.3 8.4
AR-1 Governance and
Privacy Program. TR-1
PRIVACY NOTICE. TR-3

DISSEMINATION OF

PRIVACY PROGRAM

INFORMATION
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII
used in Testing, Training,
and Research.

TR-2 SYSTEM OF

RECORDS NOTICES AND

PRIVACY ACT

STATEMENTS
TR-2 SYSTEM OF

RECORDS NOTICES AND

PRIVACY ACT

STATEMENTS
DM-1 Minimization of
Personally Identifiable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII
used in Testing, Training,
and Research. SE-1

INVENTORY OF

PERSONALLY

IDENTIFIABLE

INFORMATION
DM-2 DATA RETENTION

AND DISPOSAL

99.31.(a)(1)(ii)
ITOS > Service
Support >
Configuration
Management -
Physical
Inventory
provider x
SRM > Policies
and Standards >
Information
Security Policies
(Facility Security
Policy)
provider x
SRM >
Cryptographic
Services > Key
Management
shared x
SRM > Data
Protection >
Cryptographic
Services - Data-AtRest Encryption,
Cryptographic
Services - Data-inTransit Encryption
shared x
SRM >
Cryptographic
Services > Key
Management
shared x
SRM >
Governance Risk
& Compliance >
Technical
Standards
BOSS >
Operational Risk
Management >
Independent Risk
Management
shared x
ITOS > Service
Support > Release
Management
shared x
BOSS > Data
Governance >
Data
Classification
shared x
BOSS > Data
Governance >
Handling /
Labeling /
Security Policy
x
BOSS > Data
Governance >
Handling /
Labeling /
Security Policy
shared x
shared x
312.3
312.8 and 312.10
312.2
312.3
312.8 and 312.10
312.8 and 312.10
312.1
APO11.01
APO11.02
APO11.04
APO11.05
BAI02.04
BAI03.06
BAI03.08
BAI07.03
BAI07.05
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06
APO01.06
APO03.01
APO03.02
APO09.01
APO09.01
BAI06.03
BAI09.01
BAI10.01
BAI10.02
BAI10.03
BAI10.04
BAI10.05
APO01.06
APO03.02
APO08.01
APO13.01
APO13.02
DSS05
DSS06
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06
APO01.06
APO13.01
BAI09.03
DSS01.01
APO01.06
APO03.02
APO08.01
APO09.03
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06
APO13.01
DSS01.04
DSS01.05
DSS04.01
DSS04.03
APO13.01
APO13.02
APO09.03
BAI06.01
BAI09.01
BAI09.02
BAI09.03
APO13.01
DSS05.02
DSS05.03
DSS06.06
APO01.06
BAI09.02
BAI09.03
APO01.06
APO03.02
APO13.01
APO13.02
BAI02.01
BAI02.03
BAI02.04
BAI06.01
BAI10.01
BAI10.02
MEA02.01
CC3.2
CC3.1
CC3.1
CC7.1
CC7.1
CC7.1
CC7.1
CC7.4
CC3.1
CC3.1
CC5.7
PI1.5
CC5.1
C1.3
CC5.6
CC3.1
CC3.1
Domain 5
CC5.5
CC5.7
CC5.6
CC5.7
CC5.6
CA-3
RA-2
RA-3
MP-8
PM-9
SI-12
PCI DSS v2.0

12.1 PCI DSS v2.0

12.1.2 EDM03.02
APO01.03
APO12.01
APO12.02
APO12.03
APO12.04
BAI09.01
AR-2 Privacy Impact and
Risk Assessment
A.12.1.1
A.15.2.2
Commandment #2
Commandment #4
Commandment #5
Commandment
#11
Chapter II, Article 19 and
Chapter VI, Section I, Article
39 312.8 and 312.10 shared x CM-2
SA-2
SA-4
PCI DSS v1.2

1.1 PCI DSS v1.2

1.1.1 PCI DSS v1.2

1.1.2 PCI DSS v1.2

1.1.3 PCI DSS v1.2

1.1.4 PCI DSS v1.2

1.1.5 PCI DSS v1.2

1.1.6 PCI DSS v1.2

2.2 PCI DSS v1.2

2.2.1 PCI DSS v1.2

2.2.2 PCI DSS v1.2

2.2.3 PCI DSS v1.2

2.2.4 Governance and Risk
Management
Risk Assessments
GRM02Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following:
• Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure • Compliance with defined retention periods and end-of-life disposal requirements
• Data classification and protection from unauthorized use, access, loss, destruction, and falsification
S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(C3.14.0) Procedures exist to provide that system
data are classified in accordance with the defined
confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to
define protection requirements, access rights and
access restrictions, and retention and destruction
policies.
c. Assessing risks on a periodic basis.

L.4, L.5, L.6,
L.7
34 (B) Schedule 1
(Section 5), 4.7 -
Safeguards
DG-08 COBIT 4.1 PO

9.1, PO 9.2, PO

9.4, DS 5.7
Domain 5 6.01. (d)

6.04.03. (a)
Article 6, Article 8, Article 17
(1)
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12

1.2.4 8.2.1
45 CFR
164.308(a)(1)(ii)
(A) (New)
45 CFR
164.308(a)(8)
(New)
Clause 4.2.1 c) &
g)
Clause 4.2.3 d)
Clause 4.3.1 &

4.3.3 Clause 7.2 & 7.3
A.7.2
A.15.1.1
A.15.1.3
A.15.1.4
EAR 15
CFR
§736.2 (b)
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
Commandment #9
Commandment
#10
Commandment
#11
45 CFR 164.312
(a)(2)(iv)
45 CFR 164.312
(e)(1)
45 CFR 164.312
(e)(2)(ii)
A.10.6.1
A.10.8.3
A.10.8.4
A.10.9.2
A.10.9.3
A.12.3.1
A.15.1.3
A.15.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment
#10
Commandment
#11
Encryption & Key
Management
Key Generation
EKM02Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over
implementation of the control.

CIP-003-3 -
R4.2
AC-18
IA-3
IA-7
SC-7
SC-8
SC-9
SC-13
SC-16
SC-23
SI-8
PCI-DSS v2.0

2.1.1 PCI-DSS v2.0

3.4 PCI-DSS v2.0

3.4.1 PCI-DSS v2.0

4.1 PCI-DSS v2.0

4.1.1 PCI DSS v2.0

4.2 Encryption & Key
Management
Storage and Access
EKM04Platform and data appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required.

Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties.

Governance and Risk
Management
Baseline Requirements
GRM01Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal, statutory and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use.

Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and established and authorized based on business need.

S1.1.0
S1.2.0(ai)
(S1.1.0) The entity’s security policies are
established and periodically reviewed and
approved by a designated individual or group.
(S1.2.0(a-i)) The entity's security policies include,
but may not be limited to, the following matters:

L.2 L.2, L.5, L.7
L.8, L.9, L.10
12 (B)
14 (B)
13 (B)
15 (B)
16 (C+,
A+)
21 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards
IS-04 COBIT 4.1 AI2.1
COBIT 4.1 AI2.2
COBIT 4.1 AI3.3
COBIT 4.1 DS2.3
COBIT 4.1 DS11.6
Domain 2 6.03.01. (a)

6.03.04. (a)

6.03.04. (b)

6.03.04. (c)

6.03.04. (e)

6.07.01. (o)
Article 17 NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SC-30

1.2.6 8.2.1

8.2.7 Encryption & Key
Management
Encryption
EKM03Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations) and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.

C3.12.0
S3.6.0
S3.4
(C3.12.0, S3.6.0) Encryption or other equivalent
security techniques are used to protect
transmissions of user authentication and other
confidential information passed over the Internet
or other public networks.
(S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.4
G.15
I.3
G.10.4, G.11.1,
G.11.2, G.12.1,
G.12.2, G.12.4,
G.12.10,
G.14.18,
G.14.19,
G.16.2,
G.16.18,
G.16.19,
G.17.16,
G.17.17,
G.18.13,
G.18.14,
G.19.1.1,
G.20.14
23 (B)
24 (B)
25 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-18 COBIT 4.1 DS5.8
COBIT 4.1 DS5.10
COBIT 4.1 DS5.11
Domain 2 6.04.05. (a)

6.04.05. (c)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-23
NIST SP 800-53 R3 SC-28
NIST SP 800-53 R3 SI-8

8.1.1 8.2.1

8.2.5 45 CFR 164.310
(a)(1)
45 CFR 164.310
(a)(2)(ii)
45 CFR
164.308(a)(3)(ii)
(A) (New)
45 CFR 164.310
(a)(2)(iii) (New)
A.5.1.1
A.9.1.3
A.9.1.5
Commandment #1
Commandment #2
Commandment #3
Commandment #5
CIP-006-
3c R1.2 -
R1.3 -
R1.4 -R2 -
R2.2
PE-2
PE-3
PE-4
PE-5
PE-6
PCI DSS v2.0

9.1 PCI DSS v2.0

9.2 PCI DSS v2.0

9.3 PCI DSS v2.0

9.4 (S3.6.0) Encryption or other equivalent security
techniques are used to protect transmissions of
user authentication and other confidential
information passed over the Internet or other
public networks.
(S3.4) Procedures exist to protect against
unauthorized access to system resources.

L.6 38 (B)
39 (C+)
IS-19 COBIT 4.1 DS5.8 Domain 2 6.04.04. (a)

6.04.04. (b)

6.04.04. (c)

6.04.04. (d)

6.04.04. (e)

6.04.05. (d)

6.04.05. (e)

6.04.08.02. (b)
Article 17 NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-17

8.1.1 8.2.1

8.2.5 45 CFR 164.312
(a)(2)(iv)
45 CFR
164.312(e)(1)
(New)
Clause 4.3.3
A.10.7.3
A.12.3.2
A.15.1.6
Commandment #9
Commandment
#10
Commandment
#11
SC-12
SC-13
SC-17
SC-28
PCI-DSS v2.0

3.4.1 PCI-DSS v2.0

3.5 PCI-DSS v2.0

3.5.1 PCI-DSS v2.0

3.5.2 PCI-DSS v2.0

3.6 PCI-DSS v2.0

3.6.1 PCI-DSS v2.0

3.6.2 PCI-DSS v2.0

3.6.3 PCI-DSS v2.0

3.6.4 PCI-DSS v2.0

3.6.5 PCI-DSS v2.0

3.6.6 PCI-DSS v2.0

3.6.7 PCI-DSS v2.0

3.6.8 Datacenter Security 99.31.a.1.ii
Policy
DCS06Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas.

A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.

H.6 F.1.2.3,
F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.4.2,
F1.4.6,
F.1.4.7, F.1.7,
F.1.8, F.2.13,
F.2.14, F.2.15,
F.2.16, F.2.17,
F.2.18
7 (B) Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-01 COBIT 4.1 DS5.7,
DS 12.1, DS 12.4
DS 4.9
Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 PE-5
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)

8.2.1 8.2.2

8.2.3 CIP-007-3 -
R7 - R7.1 -
R7.2 R7.3
MP-6
PE-1
PCI DSS v2.0

3.1.1 PCI DSS v2.0

9.10 PCI DSS v2.0

9.10.1 PCI DSS v2.0

9.10.2 PCI DSS v2.0

3.1 Datacenter Security
Asset Management
DCS01Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership y defined roles and responsibilities.

S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(C3.14.0) Procedures exist to provide that system
data are classified in accordance with the defined
confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to
define protection requirements, access rights and
access restrictions, and retention and destruction
policies.
c. Assessing risks on a periodic basis.

Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
FS-08 Domain 8 Article 17 45 CFR 164.310
(d)(2)(iii)
A.7.1.1
A.7.1.2
Data Security &
Information Lifecycle
Management
Secure Disposal
DSI-07 Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements.

PCI DSS v2.0

9.9.1 PCI DSS v2.0

12.3.3 PCI DSS v2.0

12.3.4 NIST SP800-53 R3 CM-8
BOSS > Data
Governance >
Secure Disposal
of Data
C3.5.0
S3.4.0
(C3.5.0) The system procedures provide that
confidential information is disclosed to parties only
in accordance with the entity’s defined
confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against
unauthorized access to system resources.

D.2.2.10,
D.2.2.11,
D.2.2.14,
37 (B) Schedule 1
(Section 5) 4.5 -
Limiting Use,
Disclosure and
Retention, Subsec.

4.7.5 and 4.5.3
DG-05 COBIT 4.1 DS

11.4 Domain 5 6.03. (h) Article 16
Article 17
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)
NIST SP 800-53 R3 PE-1

5.1.0 5.2.3
AC-14
AC-21
AC-22
IA-8
AU-10
SC-4
SC-8
SC-9
PCI-DSS v2.0

2.1.1 PCI-DSS v2.0

4.1 PCI-DSS v2.0

4.1.1 PCI DSS v2.0

4.2 A.7.2.2
A.10.7.1
A.10.7.3
A.10.8.1
Commandment #8
Commandment #9
Commandment
#10
Chapter II
Article 8, 9, 11, 12, 14, 18, 19,
20, 21
CIP-003-3 -
R4 - R4.1
AC-16
MP-1
MP-3
PE-16
SI-12
SC-9
PCI DSS v2.0

9.5 PCI DSS v2.0

9.6 PCI DSS v2.0

9.7.1 PCI DSS v2.0

9.7.2 PCI DSS v2.0

9.10 SRM >
Cryptographic
Services > Data in
Transit Encryption
shared
45 CFR 164.310
(d)(2)(i)
45 CFR 164.310
(d)(2)(ii)
A.9.2.6
A.10.7.2
Commandment
#11
Data Security &
Information Lifecycle
Management
Handling / Labeling /
Security Policy
DSI-04 Policies and procedures shall be established for labeling, handling, and the security of data and objects which contain data.

Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.

S3.2.a (S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.

G.13 D.2.2 DG-03 COBIT 4.1 PO

2.3, DS 11.6
Domain 5 6.03.05. (b) Article 22
Article 23
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-16
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12

1.1.2 5.1.0

7.1.2 8.1.0

8.2.5 8.2.6
Data Security &
Information Lifecycle
Management
Data Inventory / Flows
DSI-02 Policies and procedures shall be established to inv entory , document, and maintain data f lows f or data that is resident (permanently or temporarily ) within the serv ice's applications and inf rastructure network and sy stems. In particular, prov iders shall ensure that data that is subject to geographic residency requirements not be migrated bey ond its def ined bounds.

Data Security &
Information Lifecycle
Management
eCommerce
Transactions
DSI-03 Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data.

S3.6
I13.3.a-e
I3.4.0
(S3.6) Encryption or other equivalent security
techniques are used to protect transmissions of
user authentication and other confidential
information passed over the Internet or other
public networks.
(I13.3.a-e) The procedues related to
completeness, accuracy, timeliness, and
authorization of system processing, including error
correction and database management, are
consistent with documented system processing
integrity policies.
(I3.4.0) The procedures related to completeness,
accuracy, timeliness, and authorization of outputs
are consistent with the documented system
processing integrity policies.

G.4
G.11
G.16
G.18
I.3
I.4
G.19.1.1,
G.19.1.2,
G.19.1.3,
G.10.8, G.9.11,
G.14, G.15.1
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-28 COBIT 4.1 DS

5.10 5.11
Domain 2 Article 17
PCI DSS v2.0

1.1.1 PCI DSS v2.0

6.1 PCI DSS v2.0

6.4 Data Security &
Information Lifecycle
Management
Classification
DSI-01 Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization.

S3.8.0
C3.14.0
(S3.8.0) Procedures exist to classify data in
accordance with classification policies and
periodically monitor and update such
classifications as necessary.
(C3.14.0) Procedures exist to provide that system
data are classified in accordance with the defined
confidentiality and related security policies.

D.1.3, D.2.2 DG-02 COBIT 4.1 PO

2.3, DS 11.6
Domain 5 6.04.03. (a) Article 4 (1),
Article 12, Article 17
NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 AC-4

1.2.3 1.2.6

4.1.2 8.2.1

8.2.5 8.2.6
A.7.2.1 Commandment #9
Change Control &
Configuration
Management
Quality Testing
CCC-03 Organization shall follow a defined qualty change control and testing process (e.g. ITIL Service Management) with established baselines, testing and release standards which focus on system availability, confidentiality and integrity of systems and services
General Provisions, Article 3,
V. and VI.

CIP-003-3 -
R4 - R5
RA-2
AC-4
PCI DSS v2.0

9.7.1 PCI DSS v2.0

9.10 PCI DSS v2.0

12.3 None 6.03.01. (b)

6.03.01. (d)
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)

9.1.0 9.1.1

9.2.1 9.2.2
A.6.1.3
A.10.1.1
A.10.1.4
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
Commandment #1
Commandment #2
Commandment #3
Domain 11
A.6.1.1
A.12.1.1
A.12.1.4
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* partial
A.14.2.2

8.1* partial
A.14.2.3

8.1* partial
A.14.2.4
A.12.6.1
A.16.1.3
A.18.2.2
A.18.2.3
A.8.2.1
Clause

4.2 5.2,

7.5,

8.1 A.8.2.1
A.13.1.1
A.13.1.2
A.14.1.2
A.14.1.3
A.18.1.4
A.8.2.2
A.8.3.1
A.8.2.3
A.13.2.1
A.11.2.7
A.8.3.2
Annex A.8
A.11.1.1
A.11.1.2
Clauses

5.2(c)

5.3(a)

5.3(b)

7.5.3(b)

7.5.3(d)

8.1 8.3

9.2(g)
A.8.2.3
A.10.1.2
A.18.1.5
A.13.1.1
A.8.3.3
A.13.2.3
A.14.1.3
A.14.1.2
A.10.1.1
A.18.1.3
A.18.1.4
Annex
A.10.1
A.10.1.1
A.10.1.2
A3.13.0
C3.16.0
I3.14.0
S3.10.0
S3.13
(A3.13.0, C3.16.0, I3.14.0, S3.10.0) Design,
acquisition, implementation, configuration,
modification, and management of infrastructure
and software are consistent with defined system
availability, confidentiality of data, processing
integrity, systems security and related security
policies.
(S3.13) Procedures exist to provide that only
authorized, tested, and documented changes are
made to the system.

C.1.7, G.1, G.6,
I.1, I.4.5,
I.2.18, I.22.1,
I.22.3, I.22.6,
I.2.23,
I.2.22.2,
I.2.22.4,
I.2.22.7.

I.2.22.8,
I.2.22.9,
I.2.22.10,
I.2.22.11,
I.2.22.12,
I.2.22.13,
I.2.22.14,I.2.2
0, I.2.17,
I.2.7.1, I.3,
J.2.10, L.9
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
RM-03 COBIT 4.1 PO 8.1
A.14.1.1
A.18.2.3
Clauses

5.2(c)

5.3(a)

5.3(b)

6.1.2 6.1.2(a)(2)

6.1.3(b)

7.5.3(b)

7.5.3(d)

8.1 8.2

8.3 9.2(g)
A.18.1.1
A.18.1.3
A.18.1.4
A.8.2.2
CM-1
CM-2
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-13
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)

3.2.4 4.2.3

7.1.2 7.2.1

7.2.2 8.2.1

8.2.5 45 CFR
164.312(e)(1)
45 CFR
164.312(e)(2)(i)
A.7.2.1
A.10.6.1
A.10.6.2
A.10.9.1
A.10.9.2
A.15.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment
#10
Commandment
#11
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 85
#2..
- 129 -
GRM04.1
An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business:
• Risk management
• Security policy
• Organization of information security
• Asset management
• Human resources security
• Physical and environmental security
• Communications and operations management
• Access control
• Information systems acquisition, development, and maintenance Do you provide tenants with documentation describing your Information Security Management Program (ISMP)?
GRM04.2Do you review your Information Security Management Program (ISMP) least once a year?
Governance and Risk
Management
Management Support
/ Involvement
GRM05GRM05.1Executive and line management shall take formal action to support information security through clearly-documented direction and commitment, and shall ensure the action has been assigned.

Do you ensure your providers adhere to your information security and privacy policies?
S1.3.0 (S1.3.0) Responsibility and accountability for
developing and maintaining the entity’s system
security policies, and changes and updates to
those policies, are assigned.

The entity has prepared an objective description of
the system and its boundaries and communicated
such description to authorized users
The security obligations of users and the entity’s
security commitments to users are communicated
CC1.2 C.1 5 (B) Schedule 1
(Section 5), 4.1
Safeguards,
Subsec. 4.1.1
IS-02 COBIT 4.1 DS5.1 APO01.02
APO01.03
APO01.04
APO01.08
APO13.01
APO13.02
APO13.03
312.8 and 312.10 SRM >
Governance Risk
& Compliance >
Compliance
Management
shared x Domain 2 Article 17 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-1 8.2.1 45 CFR 164.316 (b)(2)(ii)
45 CFR 164.316
(b)(2)(iii)
Clause 5
A.6.1.1
All in section 5
plus clauses

4.4 4.2(b)

6.1.2(a)(1)

6.2 6.2(a)

6.2(d)

7.1 7.4

9.3 Commandment #3
Commandment #6
Chapter VI, Section I, Article
39 CIP-003-3 -
R1 - R1.1
CM-1
PM-1
PM-11

4.1 PCI DSS v2.0

12.5 12.4
GRM06.1Do your information security and privacy policies align with industry standards (ISO-27001, ISO-22307, CoBIT, etc.)?
GRM06.2Do you have agreements to ensure your providers adhere to your information security and privacy policies?
GRM06.3Can you provide evidence of due diligence mapping of your controls, architecture and processes to regulations and/or standards? GRM06.4Do you disclose which controls, standards, certifications and/or regulations you comply with?
GRM07.1Is a formal disciplinary or sanction policy established for employees who have violated security policies and procedures?
GRM07.2Are employees made aware of what actions could be taken in the event of a violation via their policies and procedures? Governance and Risk
Management
Business / Policy
Change Impacts
GRM08GRM08.1Risk assessment results shall include updates to security policies, procedures, standards, and controls to ensure that they remain relevant and effective.

Do risk assessment results include updates to security policies, procedures, standards and controls to ensure they remain relevant and effective?
B.2
G.21
L.2
B.1.1, B.1.2,
B.1.6, B.1.7.2,
G.2, L.9, L.10
Schedule 1
(Section 5), 4.7 -
Safeguards
RI-04 COBIT 4.1 PO 9.6 APO12
APO13.01
APO13.03
312.8 and 312.10 BOSS >
Operational Risk
Management >
Risk
Management
Framework
shared x Domain 2,
4 6.03. (a) Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
Clause 4.2.3
Clause 4.2.4
Clause 4.3.1
Clause 5
Clause 7
A.5.1.2
A.10.1.2
A.10.2.3
A.14.1.2
A.15.2.1
A.15.2.2
Clause

4.2.1 a,

4.2(b)

4.3 c,

4.3(a&b)

4.4 5.1(c)

5.1(d)

5.1(e)

5.1(f)

5.1(g)

5.1(h)

5.2 5.2 e,

5.2(f)

5.3 6.1.1(e)(2),

6.1.2(a)(1)

6.2 CIP-009-3 -
R2
CP-2
RA-2
RA-3
AR-2 Privacy Impact and
Risk Assessment

4.3 PCI DSS v2.0

12.1.3 12.2
GRM09.1Do you notify your tenants when you make material changes to your information security and/or privacy policies?
GRM09.2Do you perform, at minimum, annual reviews to your privacy and security policies?
GRM10.1Are formal risk assessments aligned with the enterprise-wide framework and performed at least annually, or at planned intervals, determining the likelihood and impact of all identified risks, using qualitative and quantitative methods?
GRM10.2Is the likelihood and impact associated with inherent and residual risk determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance)?
GRM11.1Do you have a documented, organization-wide program in place to manage risk?
GRM11.2Do you make available documentation of your organization-wide risk management program?
HRS-01.1 Are systems in place to monitor for privacy breaches and notify tenants expeditiously if a privacy event may have impacted their data?
HRS-01.2 Is your Privacy Policy aligned with industry standards? Human Resources
Background Screening
HRS02HRS-02.1 Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk.

Pursuant to local laws, regulations, ethics and contractual constraints, are all employment candidates, contractors and involved third parties subject to background verification? S3.11.0 (S3.11.0) Procedures exist to help ensure that
personnel responsible for the design,
development, implementation, and operation of
systems affecting confidentiality and security have
the qualifications and resources to fulfill their
responsibilities.

CC1.3
CC1.4
E.2 E.2 63 (B)
HR-01
Schedule 1
(Section 5), 4.7
Safeguards,
Subsec. 4.7.3
COBIT 4.1 PO 7.6 APO07.01
APO07.05
APO07.06
312.8 and 312.10 BOSS > Human
Resources
Security >
Background
Screening
shared x None 6.01. (a) Article 17 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-3
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-3

1.2.9 A.8.1.2 A.7.1.1 ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #2
Commandment #3
Commandment #6
Commandment #9
CIP-004-3 -
R2.2
PS-2
PS-3

9.29 PA27 BSGP PCI DSS v2.0

12.7 PCI DSS v2.0

12.8.3 12.7

12.8.3 HRS-03.1 Do you specifically train your employees regarding their specific role and the information security controls they must fulfill? HRS-03.2 Do you document employee acknowledgment of training they have completed?
HRS-03.3 Are all personnel required to sign NDA or Confidentiality Agreements as a condition of employment to protect customer/tenant information?
HRS-03.4 Is successful and timed completion of the training program considered a prerequisite for acquiring and maintaining access to sensitive systems?
HRS-03.5 Are personnel trained and provided with awareness programs at least once a year?
HRS-04.1 Are documented policies, procedures and guidelines in place to govern change in employment and/or termination?
HRS-04.2 Do the above procedures and guidelines account for timely revocation of access and return of assets?
Human Resources
Portable / Mobile
Devices
HRS05HRS-05.1 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring).

Are policies and procedures established and measures implemented to strictly limit access to your sensitive data and tenant data from portable and mobile devices (e.g. laptops, cell phones and personal digital assistants (PDAs)), which are generally higher-risk than nonportable devices (e.g., desktop computers at the provider organization’s facilities)?
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

CC5.6 G.11, G12,
G.20.13,
G.20.14
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-32 COBIT 4.1 DS5.11
COBIT 4.1 DS5.5
APO01.08
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.07
DSS06.03
DSS06.06
312.8 and 312.10 Presentation
Services >
Presentation
Platform >
Endpoints -
Mobile Devices -
Mobile Device
Management
shared x Domain 2 Article 17 NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 AC-19 (1)
NIST SP 800-53 R3 AC-19 (2)
NIST SP 800-53 R3 AC-19 (3)
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)

1.2.6 3.2.4

8.2.6 45 CFR 164.310
(d)(1)
A.7.2.1
A.10.7.1
A.10.7.2
A.10.8.3
A.11.7.1
A.11.7.2
A.15.1.4
A.8.2.1
A.8.3.1
A.8.3.2
A.8.3.3
A.6.2.1
A.6.2.2
A.18.1.4
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
All CIP-007-3 -
R7.1
AC-17
AC-18
AC-19
MP-2
MP-4
MP-6

19.1 19.2

19.3 PA33
PA34
SGP
SGP
PCI DSS v2.0

9.7 PCI DSS v2.0

9.7.2 PCI DSS v2.0

9.8 PCI DSS v2.0

9.9 PCI DSS v2.0

11.1 PCI DSS v2.0

12.3 11.1

12.3 Human Resources
Nondisclosure
Agreements
HRS06HRS-06.1 Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented, and reviewed at planned intervals.

Are requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details identified, documented and reviewed at planned intervals?
S4.1.0 (S4.1.0) The entity’s system availability,
confidentiality, processing integrity and security
performance is periodically reviewed and
compared with the defined system availability and
related security policies.

CC4.1 C.2.5 Schedule 1
(Section 5), 4.7 -
Safeguards
LG-01 APO01.02
APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03
312.8 and 312.10 BOSS >
Compliance >
Intellectual
Property
Protection
shared x Domain 3 Article 16 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)

1.2.5 ISO/IEC
27001:2005
Annex A.6.1.5
A.13.2.4 ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #6
Commandment #7
Commandment #8
Commandment #9
PL-4
PS-6
SA-9
DI-2 DATA INTEGRITY

AND DATA INTEGRITY
BOARD
a. Documents processes
to ensure the integrity of
personally identifiable
information (PII) through
existing security controls;
and
PA7 BSGP PCI DSS v2.0

12.8.2 PCI DSS v2.0

12.8.3 PCI DSS v2.0

12.8.4 Human Resources
Roles / Responsibilities
HRS07HRS-07.1 Roles and responsibilities of contractors, employees, and third-party users shall be documented as they relate to information assets and security.

Do you provide tenants with a role definition document clarifying your administrative responsibilities versus those of the tenant? S1.2.f (S1.2.f) f. Assigning responsibility and
accountability for system availability,
confidentiality, processing integrity and related
security.

B.1 B.1.5,
D.1.1,D.1.3.3,
E.1, F.1.1,
H.1.1, K.1.2
5 (B) Schedule 1
(Section 5) 4.1
Accountability
IS-13 COBIT 4.1 DS5.1 APO01.02
APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03
312.3, 312.8 and
312.10
BOSS > Human
Resources
Security > Roles
and
Responsibilities
shared x Domain 2 Article 17 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

99.31(a)(1)(ii) 1.2.9

8.2.1 Clause 5.1 c)
A.6.1.2
A.6.1.3
A.8.1.1
Clause 5.3
A.6.1.1
A.6.1.1
Commandment #6
Commandment #7
Commandment #8
AT-3
PL-4
PM-10
PS-1
PS-6
PS-7
AR-1 GOVERNANCE AND

PRIVACY PROGRAM
Control: The organization:

Supplemental Guidance:

The development and
implementation of a
comprehensive
governance and privacy
program demonstrates
organizational
accountability for and
commitment to the
protection of individual

2.2 PA9
PA24
BSGP 12.8.5
HRS-08.1 Do you provide documentation regarding how you may or access tenant data and metadata?
HRS-08.2 Do you collect or create metadata about tenant data usage through inspection technologies (search engines, etc.)?
HRS-08.3 Do you allow tenants to opt out of having their data/metadata accessed via inspection technologies?
HRS-09.1 Do you provide a formal, role-based, security awareness training program for cloud-related access and data management issues (e.g., multi-tenancy, nationality, cloud delivery model segregation of duties implications and conflicts of interest) for all persons with access to tenant data?
HRS-09.2 Are administrators and data stewards properly educated on their legal responsibilities with regard to security and data integrity? HRS-10.1 Are users made aware of their responsibilities for maintaining awareness and compliance with published security policies, procedures, standards and applicable regulatory requirements? HRS-10.2 Are users made aware of their responsibilities for maintaining a safe and secure working environment?
HRS-10.3 Are users made aware of their responsibilities for leaving unattended equipment in a secure manner?
HRS-11.1 Do your data management policies and procedures address tenant and service level conflicts of interests?
HRS-11.2 Do your data management policies and procedures include a tamper audit or software integrity function for unauthorized access to tenant data?
HRS-11.3 Does the virtual machine management infrastructure include a tamper audit or software integrity function to detect changes to the build/configuration of the virtual machine?
IAM-01.1 Do you restrict, log and monitor access to your information security management systems? (E.g., hypervisors, firewalls, vulnerability scanners, network sniffers, APIs, etc.)
IAM-01.2 Do you monitor and log privileged access (administrator level) to information security management systems?
IAM-02.1 Do you have controls in place ensuring timely removal of systems access that is no longer required for business purposes? IAM-02.2 Do you provide metrics to track the speed with which you are able to remove systems access that is no longer required for business purposes?
Identity & Access
Management
Diagnostic /
Configuration Ports
Access
IAM03IAM-03.1 User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.

Do you use dedicated secure networks to provide management access to your cloud service infrastructure?
S3.2.g (S3.2.g) g. Restriction of access to system
configurations, superuser functionality, master
passwords, powerful utilities, and security devices
(for example, firewalls).

CC5.1 H1.1, H1.2,
G.9.15
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-30 COBIT 4.1 DS5.7 APO13.01
DSS05.02
DSS05.03
DSS05.05
DSS06.06
312.8 and 312.10 SRM > Privilege
Management
Infrastructure >
Privilege Usage
Management -
Resource
Protection
provider x Domain 2 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)

8.2.2 A.10.6.1
A.11.1.1
A.11.4.4
A.11.5.4
A.13.1.1
A.9.1.1
A.9.4.4
Commandment #3
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
CIP-007-3 -
R2
CM-7
MA-3
MA-4
MA-5

15.4 PCI-DSS v2.0

9.1.2 1.2.2

7.1 7.1.2

7.1.3 7.2

7.2.3 9.1.2

9.1.3 IAM-04.1 Do you manage and store the identity of all personnel who have access to the IT infrastructure, including their level of access? IAM-04.2 Do you manage and store the user identity of all personnel who have network access, including their level of access?

9.3 12.3

12.6 12.4

8.1.8 10.5

7.1.2 7.1.4

7.2 8.1

8.1.5 8.5

3.5.1, 7.0

8.0 12.5.4

7.3 8.8

9.10 7.3, 8.8, 9.10, 12.1

12.2 12.1.1

12.2 12.2
PA27 BSGP
PA27 BSGP
BSGP
PA28 BSGP
PA30 BSGP
PA2
PA15
BSGP
SGP

1.1 3.3

5.1 5.2

5.3 5.4

7.1 12.2

17.7 18.1

18.3 3.2 (responsibility)

3.3 3.4

4.1 4.3

5.2 (residual Risk)

2.2 9.2

2.2 5.2

4.2 9.1

9.1 8.1

15.4 15.1

15.2 4.2

4.3 4.4

4.5 4.1

6.1 AR-2 Privacy Impact and
Risk Assessment
AR-5 PRIVACY

AWARENESS AND

TRAINING
Control: The organization:
a. Develops, implements,
and updates a
comprehensive training
and awareness strategy
aimed at ensuring that
personnel understand
privacy responsibilities
and procedures;
b. Administers basic
privacy training
[Assignment:
organization-defined
frequency, at least
annually] and targeted,
role-based privacy
training for personnel
having responsibility for
personally identifiable
information (PII) or for
activities that involve PII
[Assignment:
organization-defined
frequency, at least
annually]; and
c. Ensures that personnel
certify (manually or
electronically) acceptance
of responsibilities for
privacy requirements
[Assignment:

UL-1 INTERNAL USE
Control: The organization
uses personally
identifiable information
(PII) internally only for
the authorized purpose(s)
identified in the Privacy
Act and/or in public
notices.

99.31(a)(i)(ii)

99.31(a)(1)(ii)
SRM > Privilege
Management
Infrastructure >
Privilege Usage
Management
shared x
SRM > Policies
and Standards >
shared x
BOSS > Human
Resources
Security >
Employee
Awareness
shared x
BOSS > Data
Governance >
Clear Desk Policy
shared x
SRM > Policies
and Standards >
Information
Security Policies
SRM > InfoSec
Management >
Capabilitiy
Mapping
SRM > Policies
and Standards >
Information
Security Policies
shared x
SRM >
Governance Risk
& Compliance >
shared x
SRM >
Governance Risk
& Compliance >
Policy
Management
shared x
shared x
BOSS >
Operational Risk
Management >
Risk
Management
Framework
shared x
SRM > Policies
and Standards >
Information
Security Policies
shared x
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
APO01.02
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS05.05
DSS05.06
DSS06.03
DSS06.06
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.06
APO01.03
APO01.08
APO07.04
APO12
APO13.01
APO13.03
MEA03.01
MEA03.02
APO12
EDM03.02
APO01.03
APO12
APO01.03
APO13.01
APO07.06
APO09.03
APO10.01
APO01.02
APO07.05
APO07.06
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS06.06
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.03
DSS05.05
CC3.2
CC1.2
CC2.3
CC6.2
CC2.5
CC3.2
CC3.1
CC3.3
CC3.1
CC5.6
CC2.2
CC2.3
CC5.4
CC3.2
CC6.2
CC2.2
CC2.3
CC5.1
CC5.5
CC5.6
45 CFR 164.308
(a)(3)(i)
45 CFR 164.312
(a)(1)
45 CFR 164.312
(a)(2)(ii)
45 CFR
164.308(a)(4)(ii)
(B) (New)
45 CFR
164.308(a)(4)(ii)
(c ) (New)
A.11.1.1
A.11.2.1
A.11.2.4
A.11.4.1
A.11.5.2
A.11.6.1
S3.2.g Commandment #6
Commandment #7
Commandment #8
CIP-007-3 -
R5.1 -
R5.1.2
AC-1
IA-1
PCI DSS v2.0

3.5.1 PCI DSS v2.0

8.5.1 PCI DSS v2.0

12.5.4 Identity & Access
Management
Policies and Procedures
IAM04Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity.

Identity & Access
Management
User Access Policy
IAM02User access policies and procedures shall be established, and supporting business processes and technical measures
implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following:
• Procedures and supporting roles and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customercontrolled access, suppliers' business relationships, or other thirdparty business relationships) • Business case considerations for higher levels of assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access, segregation of duties, emergency access, large-scale provisioning or geographically-distributed deployments, and personnel redundancy for critical systems) • Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant))
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
• Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and strong/multifactor, expireable, non-shared authentication secrets) • Permissions and supporting capabilities for customer (tenant) controls over authentication, authorization, and accounting (AAA) rules for access to data and sessions
• Adherence to applicable legal, statutory, or regulatory compliance requirements
S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to,
the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).

B.1 B.1.8, B.1.21,
B.1.28, E.6.2,
H.1.1, K.1.4.5,
8 (B)
40 (B)
41 (B)
42 (B)
43 (B)
44 (C+)
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4; 4.7
Safeguards, Subs.

4.7.4 IS-07 COBIT 4.1 DS 5.4 Domain 2 6.01. (b)

6.01. (d)

6.02. (e)

6.03. (b)

6.03.04. (b)

6.03.04. (c)

6.03.05. (b)

6.03.05. (d)

6.03.06. (b)

6.04.01. (c)

6.04.01. (f)

6.04.02. (a)

6.04.02. (b)

6.04.02. (c)

6.04.03. (b)

6.04.06. (a)

6.04.08. (a)

6.04.08. (b)

6.04.08. (c)

6.04.08.03. (a)

6.04.08.03. (b)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1
Identity & Access
Management
Audit Tools Access
IAM01Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segmented and restricted to prevent compromise and misuse of log data.

S3.2.g (S3.2.g) g. Restriction of access to system
configurations, superuser functionality, master
passwords, powerful utilities, and security devices
(for example, firewalls).

Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-29 COBIT 4.1 DS 5.7 Domain 2 6.03. (i)

6.03. (j)
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-10
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1

8.1.0 NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2)

8.2.1 A.15.3.2 Commandment #2
Commandment #5
Commandment
#11
CIP-003-3 -
R5.2
AU-9
AU-11
AU-14
PCI DSS v2.0

10.5.5 AT-2
AT-3
AT-4
PL-4
PCI DSS v2.0

8.5.7 PCI DSS v2.0

12.6.1 Human Resources
Workspace
HRS11Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions had been disabled after an established period of inactivity.

S3.3.0
S3.4.0
(S3.3.0) Procedures exist to restrict physical access
to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
(S3.4.0) Procedures exist to protect against
unauthorized access to system resources.

E.1 E.4 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-17 Domain 2 NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2

8.2.3 Clause 5.2.2
A.8.2.2
A.9.1.5
A.11.3.1
A.11.3.2
A.11.3.3
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #5
Commandment #6
Commandment #7
Commandment
#11
Human Resources
User Responsibility
HRS10All personnel shall be made aware of their roles and responsibilities for:
• Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.
• Maintaining a safe and secure working environment
S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality,
processing integrity and security policies and
changes and updates to those policies are
communicated to entity personnel responsible for
implementing them.

E.1 E.4 65 (B)
66 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.4
IS-16 COBIT 4.1 PO 4.6 Domain 2 Article 17 NIST SP 800-53 R3 AT-2 NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)
CC3.2 APO01.02
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
APO01.02
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
DSS05.03
DSS06.06
312.8 and 312.10
312.8 and 312.10
45 CFR 164.308
(a)(5)(i)
45 CFR 164.308
(a)(5)(ii)(A)
Clause 5.2.2
A.8.2.2
Commandment #3
Commandment #6
SRM > GRC > shared x
AC-11
MP-2
MP-3
MP-4
Chapter VI, Section I, Article
39 and Chapyer VI, Section II,
Article 41
CIP-004-3 -
R1 - R2 -
R2.1
AT-1
AT-2
AT-3
AT-4
PCI DSS v2.0

12.6 PCI DSS v2.0

12.6.1 PCI DSS v2.0

12.6.2 1.2.10

8.2.1 45 CFR 164.308
(a)(5)(ii)(D)
Clause 5.2.2
A.8.2.2
A.11.3.1
A.11.3.2
Commandment #5
Commandment #6
Commandment #7
Chapter VI, Section I, Article
39 and Chapter VI, Section II,
Article 41
Human Resources
Training / Awareness
HRS09A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.

S1.2.k
S2.2.0
(S1.2.k) The entity's security policies include, but
may not be limited to, the following matters:
k. Providing for training and other resources to
support its system security policies
(S2.2.0) The security obligations of users and the
entity’s security commitments to users are
communicated to authorized users.

E.1 E.4 65 (B) Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4; 4.7
Safeguards, Subs.

4.7.4 IS-11 COBIT 4.1 PO 7.4 Domain 2 6.01. (c)

6.02. (e)
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4

1.2.10 8.2.1
APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
312.8 and 312.10
Human Resources
Acceptable Use
HRS08Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be considered and incorporated as appropriate.

S1.2
S3.9
(S1.2) The entity’s security policies include, but
may not be limited to, the following matters:
(S3.9) Procedures exist to provide that issues of
noncompliance with security policies are promptly
addressed and that corrective measures are taken
on a timely basis.

B.3 B.1.7, D.1.3.3,
E.3.2, E.3.5.1,
E.3.5.2
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4
IS-26 COBIT 4.1 DS 5.3 Domain 2 Article 5, Article 6
Article 7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 AC-20 (1)
NIST SP 800-53 R3 AC-20 (2)
NIST SP 800-53 R3 PL-4

8.1.0 45 CFR 164.310
(b)
A.7.1.3 Commandment #1
Commandment #2
Commandment #3
Human Resources
Employment
Termination
HRS04Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.

AC-8
AC-20
PL-4
PCI-DSS v2.0

12.3.5 312.8 and 312.10
312.4, 312.8 and
312.10
BOSS > Human
Resources
Security > Roles
and
Responsibilities
S3.2.d
S3.8.e
(S3.2.d) Procedures exist to restrict logical access
to the system and information resources
maintained in the system including, but not limited
to, the following matters:
d. The process to make changes and updates to
user profiles
(S3.8.e) e. Procedures to prevent customers,
groups of individuals, or other entities from
accessing confidential information other than their
own
E.6 HR-03 COBIT 4.1 PO 7.8 None Article 17 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8

8.2.2 10.2.5
GRM11Organizations shall develop and maintain an enterprise risk management framework to mitigate risk to an acceptable level. 45 CFR 164.308
(a)(3)(ii)(C)
A.8.3.1 Commandment #6
Commandment #7
312.3, 312.8 and
312.10
312.3, 312.8 and
312.10
BOSS > Human
Resources
Security >
Employee
Termination
provider x
BOSS > Human
Resources
Security >
Employee Code
of Conduct
shared x
shared x
45 CFR 164.308
(a)(3)(ii)(C)
A.7.1.1
A.7.1.2
A.8.3.2
Governance and Risk
Management
Program
PS-4
Human Resources
Employment
Agreements
HRS03Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets.

S2.2.0 (S2.2.0) The security obligations of users and the entity's security commitments to users are
communicated to authorized users
C.1 E.3.5 66 (B) Schedule 1
(Section 5) 4.7
Safeguards,
Subsec. 4.7.4
HR-02 COBIT DS 2.1 None Article 17 NIST SP 800-53 R3 PS1 NIST SP 800-53 R3 PS2
NIST SP 800-53 R3 PS6
NIST SP 800-53 R3 PS7
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

1.2.9 8.2.6
45 CFR
164.310(a)(1)
(New)
45 CFR
164.308(a)(4)(i)
(New)
A.6.1.5
A.8.1.3
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #6
Commandment #7
PL-4
PS-6
PS-7
Human Resources
Asset Returns
HRS01Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period.

S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

D.1 E.6.4 Schedule 1
(Section 5) 4.5
Limiting Use,
Disclosure and
Retention; 4.7
Safeguards, Subs.

4.7.5 IS-27 Domain 2 Article 17 NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-4 5.2.3

7.2.2 8.2.1

8.2.6 APO01.08
APO07.06
APO13.01
BAI09.03
45 CFR 164.308
(a)(1)(ii)(A)
Clause 4.2.1 c)
through g)
Clause 4.2.3 d)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.5.2
A.12.6.1
A.14.1.2
A.15.1.1
A.15.2.1
A.15.2.2
CIP-002-3 -
R1.1 -
R1.2
CIP-005-
3a - R1 -
R1.2
CIP-009-3 -
R.1.1
PL-5
RA-2
RA-3
PCI DSS v2.0

12.1.2 BOSS >
Operational Risk
Management >
Risk
Management
Framework
S3.1
x3.1.0
(S3.1) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system [availability, processing
integrity, confidenitality] commitments and (2)
assess the risks associated with the identified
threats.

L.2 A.1, L.1 Schedule 1
(Section 5), 4.7 -
Safeguards
RI-01 COBIT 4.1 PO 9.1 Domain 2,
4 Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 CM-1
312.8 and 312.10 1.2.4 45 CFR 164.308
(a)(8)
45 CFR
164.308(a)(1)(ii)
(B) (New)
Clause 4.2.1 c)
through g)
Clause 4.2.2 b)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.6.1
A.14.1.2
A.15.2.1
A.15.2.2
Chapter II
Article 19
CIP-009-3 -
R4
AC-4
CA-2
CA-6
PM-9
RA-1
PCI DSS v2.0

12.1.2 Governance and Risk
Management
Assessments
GRM10Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).

S3.1
x3.1.0
S4.3.0
(S3.1) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system [availability, processing
integrity, confidenitality] commitments and (2)
assess the risks associated with the identified
threats.
(S4.3.0) Environmental, regulatory, and
technological changes are monitored, and their
effect on system availability, confidentiality of
data, processing integrity, and system security is
assessed on a timely basis; policies are updated
for that assessment.

I.1
I.4
C.2.1, I.4.1,
I.5, G.15.1.3,
I.3
46 (B)
74 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards
RI-02 COBIT 4.1 PO 9.4 Domain 2,
4 6.03. (a)

6.08. (a)
Article 17 (1), (2) NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-30

1.2.4 1.2.5
312.8 and 312.10
PL-4
PS-1
PS-8
Governance and Risk
Management
Policy Reviews
GRM09The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.

S1.1.0 (S1.1.0) The entity’s security policies are
established and periodically reviewed and
approved by a designated individual or group.

B.2 B.1.33. B.1.34, IS-05 COBIT 4.1 DS 5.2
DS 5.4
Domain 2 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

1.2.1 8.2.7

10.2.3 45 CFR 164.316
(b)(2)(iii)
45 CFE
164.306(e)
(New)
Clause 4.2.3 f)
A.5.1.2
Commandment #1
Commandment #2
Commandment #3
PCI DSS v2.0

12.1.3 CIP-003-3 -
R3.2 -
R3.3 -
R1.3
R3 - R3.1 -
R3.2 -
R3.3
AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-5
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
SA-1
SC-1
SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

8.1.0 8.1.1
45 CFR 164.316
(a)
45 CFR 164.316
(b)(1)(i)
45 CFR 164.316
(b)(2)(ii)
45 CFR
164.308(a)(2)
(New)
Clause 4.2.1
Clause 5
A.5.1.1
A.8.2.2
Commandment #1
Commandment #2
Commandment #3
Chapter VI, Section I, Article
39 CIP-003-3 -
R1 -R1.1 -
R1.2 - R2 -
R2.1 -
R2.2 -
R2.3
AC-1
AT-1
AU-1
CA-1
CM-1
IA-1
IR-1
MA-1
MP-1
MP-1
PE-1
PL-1
PS-1
SA-1
SC-1
SI-1
PCI DSS v2.0

12.1 PCI DSS v2.0

12.2 Governance and Risk
Management
Policy Enforcement
GRM07A formal disciplinary or sanction policy shall be established for employees who have violated security policies and procedures.

Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures.

S3.9
S2.4.0
(S3.9) Procedures exist to provide that issues of
noncompliance with security policies are promptly
addressed and that corrective measures are taken
on a timely basis.
(S2.4.0) The security obligations of users and the
entity’s security commitments to users are
communicated to authorized users.

B.1.5 Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4
IS-06 COBIT 4.1 PO 7.7 Domain 2 Article 17 NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8

10.2.4 45 CFR 164.308
(a)(1)(ii)(C)
A.8.2.3 Commandment #6
Commandment #7
Chapter X, Article 64
Governance and Risk
Management
Management Program
GRM04x1.2. (x1.2.) The entity’s system [availability,
processing integrity, confidentiality and related]
security policies include, but may not be limited to,
the following matters:

A.1, B.1 2 (B)
3 (B)
5 (B)
IS-01 COBIT 4.1 R2
DS5.2
COBIT 4.1 R2
DS5.5
Domain 2
Governance and Risk
Management
Policy
GRM06Information security policies and procedures shall be established and made readily available for review by all impacted personnel and external business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic business plan and an information security management program inclusive of defined information security roles and responsibilities for business leadership.

S1.1.0
S1.3.0
S2.3.0
(S1.1.0) The entity's security policies are
established and periodically reviewed and
approved by a designated individual or group.
(S1.3.0) Responsibility and accountability for
developing and maintaining the entity’s system
security policies, and changes and updates to
those policies, are assigned.
(S2.3.0) Responsibility and accountability for the
entity's system security policies and changes and
updates to those policies are communicated to
entity personnel responsible for implementing
them.

B.1 Schedule 1
(Section 5) 4.1
Accountability,
Subsec 4.1.4
IS-03 COBIT 4.1 DS5.2 APO01.03 Domain 2 6.02. (e)
APO01.04
APO13.01
APO13.02
Schedule 1
(Section 5), 4.1 -
Accountability; 4.7
Safeguards
Clause 8.1
A.5.1.2
Clause

4.2(b),

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 9.3(a),

9.3(b)

9.3(b)(f)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)
A.8.1.1
A.8.1.2
A.8.1.4
A.13.2.4
A.7.1.2
A.7.3.1
A.8.1.3
PCI DSS v2.0

12.4 PCI DSS v2.0

12.8.2 PS-4
PS-5
Clause 7.2(a),

7.2(b)
A.7.2.2
Clause 7.2(a),

7.2(b)
A.7.2.2
A.9.3.1
A.11.2.8
Clause 7.2(a),

7.2(b)
A.7.2.2
A.11.1.5
A.9.3.1
A.11.2.8
A.11.2.9
A.9.1.1
A.9.2.1,
A.9.2.2
A.9.2.5
A.9.1.2
A.9.4.1
Annex
A.9.2
A.9.2.1
A.9.2.2
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6
Commandment #1
Commandment #2
Chapter II, Article 19 CIP-001-
1a - R1 -
R2
CIP-003-3 -
R1 - R1.1 -
R4
CIP-006-
3c R1
PM-1
PM-2
PM-3
PM-4
PM-5
PM-6
PM-7
PM-8
PM-9
PM-10
PM-11
AR-1 Governance and
Privacy Program
Article 17 99.31.(a)(1)(ii) 8.2.1 45 CFR 4.1 PA8
164.308(a)(1)(i)
45 CFR
164.308(a)(1)(ii)
(B)
45 CFR
164.316(b)(1)(i)
45 CFR
164.308(a)(3)(i)
(New)
45 CFR
164.306(a)
(New)
Clause 4.2
Clause 5
A.6.1.1
A.6.1.2
A.6.1.3
A.6.1.4
A.6.1.5
A.6.1.6
A.6.1.7
A.6.1.8
All in sections 4,
5, 6, 7, 8, 9, 10.

A.6.1.1
A.13.2.4
A.6.1.3
A.6.1.4
A.18.2.1
PCI DSS v2.0

12.1 PCI DSS v2.0

12.2 12.1

12.2 Domain 12
Clause 4.3
Clause 5

4.4 4.2(b)

6.1.2(a)(1)

6.2 6.2(a)

6.2(d)

7.1 7.4

9.3 10.2

7.2(a)

7.2(b)

7.2(c)

7.2(d)

7.3(b)

7.3(c)
A5.1.1
A7.2.3
APO13.01
APO13.02
APO13.03
312.8 and 312.10 shared x
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 86
#2..
- 130 -
Identity & Access
Management
Segregation of Duties
IAM05IAM-05.1 User access policies and procedures shall be established, and supporting business processes and technical measures
implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest.

Do you provide tenants with documentation on how you maintain segregation of duties within your cloud service offering? S3.2.a (S3.2.a) a. Logical access security measures to
restrict access to information resources not
deemed to be public.

CC5.1 Schedule 1
(Section 5) 4.7
Safeguards, Subs.

4.7.3(b)
IS-15 COBIT 4.1 DS 5.4 APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
312.8 and 312.10 ITOS > Resource
Management >
Segregation of
Duties
shared x Domain 2 6.04.01. (d)

6.04.08.02. (a)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)

99.31(a)(1)(ii) 8.2.2 45 CFR 164.308
(a)(1)(ii)(D)
45 CFR 164.308
(a)(3)(ii)(A)
45 CFR
164.308(a)(4)(ii)
(A) (New)
45 CFR 164.308
(a)(5)(ii)(C)
45 CFR 164.312
(b)
A.10.1.3 A.6.1.2 Commandment #6
Commandment #7
Commandment #8
Commandment
#10
CIP-007-3
R5.1.1
AC-1
AC-2
AC-5
AC-6
AU-1
AU-6
SI-1
SI-4

3.0 3.1

3.2 3.3

3.4 3.5
PA24 P PCI DSS v2.0

6.4.2 6.4.2, 7.3

8.8 9.10
IAM-06.1 Are controls in place to prevent unauthorized access to your application, program or object source code, and assure it is restricted to authorized personnel only?
IAM-06.2 Are controls in place to prevent unauthorized access to tenant application, program or object source code, and assure it is restricted to authorized personnel only?
IAM-07.1 Do you provide multi-failure disaster recovery capability? IAM-07.2 Do you monitor service continuity with upstream providers in the event of provider failure?
IAM-07.3 Do you have more than one provider for each service you depend on?
IAM-07.4 Do you provide access to operational redundancy and continuity summaries, including the services you depend on?
IAM-07.5 Do you provide the tenant the ability to declare a disaster? IAM-07.6 Do you provided a tenant-triggered failover option? IAM-07.7 Do you share your business continuity and redundancy plans with your tenants?
IAM-08.1 Do you document how you grant and approve access to tenant data?
IAM-08.2 Do you have a method of aligning provider and tenant data classification methodologies for access control purposes? IAM-09.1 Does your management provision the authorization and restrictions for user access (e.g. employees, contractors, customers (tenants), business partners and/or suppliers) prior to their access to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components?
IAM-09.2 Do your provide upon request user access (e.g. employees, contractors, customers (tenants), business partners and/or suppliers) to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components? IAM-10.1 Do you require at least annual certification of entitlements for all system users and administrators (exclusive of users maintained by your tenants)?
IAM-10.2 If users are found to have inappropriate entitlements, are all remediation and certification actions recorded?
IAM-10.3 Will you share user entitlement remediation and certification reports with your tenants, if inappropriate access may have been allowed to tenant data?
IAM-11.1 Is timely deprovisioning, revocation or modification of user access to the organizations systems, information assets and data
implemented upon any change in status of employees, contractors, customers, business partners or involved third parties? IAM-11.2 Is any change in user access status intended to include termination of employment, contract or agreement, change of employment or transfer within the organization?
IAM-12.1 Do you support use of, or integration with, existing customer-based Single Sign On (SSO) solutions to your service?
IAM-12.2 Do you use open standards to delegate authentication capabilities to your tenants?
IAM-12.3 Do you support identity federation standards (SAML, SPML, WSFederation, etc.) as a means of authenticating/authorizing users? IAM-12.4 Do you have a Policy Enforcement Point capability (e.g., XACML) to enforce regional legal and policy constraints on user access? IAM-12.5 Do you have an identity management system (enabling classification of data for a tenant) in place to enable both role-based and context-based entitlement to data?
IAM-12.6 Do you provide tenants with strong (multifactor) authentication options (digital certs, tokens, biometrics, etc.) for user access? IAM-12.7 Do you allow tenants to use third-party identity assurance services? IAM-12.8 Do you support password (minimum length, age, history, complexity) and account lockout (lockout threshold, lockout duration) policy enforcement?
IAM-12.9 Do you allow tenants/customers to define password and account lockout policies for their accounts?
IAM12.10Do you support the ability to force password changes upon first logon?
IAM12.11Do you have mechanisms in place for unlocking accounts that have been locked out (e.g., self-service via email, defined challenge questions, manual unlock)?
IAM-13.1 Are utilities that can significantly manage virtualized partitions (e.g., shutdown, clone, etc.) appropriately restricted and monitored? IAM-13.2 Do you have a capability to detect attacks that target the virtual infrastructure directly (e.g., shimming, Blue Pill, Hyper jumping, etc.)?
IAM-13.3 Are attacks that target the virtual infrastructure prevented with technical controls?
IVS-01.1 Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis and response to incidents?
IVS-01.2 Is physical and logical user access to audit logs restricted to authorized personnel?
IVS-01.3 Can you provide evidence that due diligence mapping of regulations and standards to your controls/architecture/processes has been done?
IVS-01.4 Are audit logs centrally stored and retained?
IVS-01.5 Are audit logs reviewed on a regular basis for security events (e.g., with automated tools)?
IVS-02.1 Do you log and alert any changes made to virtual machine images regardless of their running state (e.g. dormant, off or running)? IVS-02.2 Are changes made to virtual machines, or moving of an image and subsequent validation of the image's integrity, made immediately available to customers through electronic methods (e.g. portals or alerts)?
Infrastructure &
Virtualization Security
Clock Synchronization
IVS-03 IVS-03.1 A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.

Do you use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference?
S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other
incidents.

CC6.2 G.7
G.8
G.13, G.14.8,
G.15.5, G.16.8,
G.17.6, G.18.3,
G.19.2.6,
G.19.3.1
20 (B)
28 (B)
30 (B)
35 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-12 COBIT 4.1 DS5.7 APO01.08
APO13.01
APO13.02
BAI03.05
DSS01.01
312.8 and 312.10 Infra Services >
Network Services
> Authoritative
Time Source
provider x Domain 10 6.03. (k) NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-8 (1)
A.10.10.1
A.10.10.6
A.12.4.1
A.12.4.4
AU-1
AU-8
PCI DSS v2.0

10.4 10.4
IVS-04.1 Do you provide documentation regarding what levels of system (network, storage, memory, I/O, etc.) oversubscription you maintain and under what circumstances/scenarios?
IVS-04.2 Do you restrict use of the memory oversubscription capabilities present in the hypervisor?
IVS-04.3 Do your system capacity requirements take into account current, projected and anticipated capacity needs for all systems used to provide services to the tenants?
IVS-04.4 Is system performance monitored and tuned in order to continuously meet regulatory, contractual and business requirements for all the systems used to provide services to the tenants?
Infrastructure &
Virtualization Security
Management -
Vulnerability
Management
IVS-05 IVS-05.1 Implementers shall ensure that the security v ulnerability assessment tools or serv ices accommodate the v irtualization technologies used (e.g. v irtualization aware).

Do security vulnerability assessment tools or services accommodate the virtualization technologies being used (e.g. virtualization aware)?
APO01.08
APO04.02
APO04.03
APO04.04
DSS05.03
DSS06.06
SRM > Threat and
Vulnerability
Management >
Vulnerability
Management
provider x Domain 1,
13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
PA36 6.1
IVS-06.1 For your IaaS offering, do you provide customers with guidance on how to create a layered security architecture equivalence using your virtualized solution?
IVS-06.2 Do you regularly update network architecture diagrams that include data flows between security domains/zones?
IVS-06.3 Do you regularly review for appropriateness the allowed access/connectivity (e.g., firewall rules) between security domains/zones within the network?
IVS-06.4 Are all firewall access control lists documented with business justification?
Infrastructure &
Virtualization Security
OS Hardening and Base
Conrols
IVS-07 IVS-07.1 Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.

Are operating systems hardened to provide only the necessary ports, protocols and services to meet business needs using technical controls (i.e antivirus, file integrity monitoring and logging) as part of their baseline build standard or template?
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.01
DSS05.03
DSS06.06
SRM > Policies
and Standards >
Operational
Security Baselines
shared x Annex
A.12.1.4
A.12.2.1
A.12.4.1
A.12.6.1

2.1 2.2

2.5 5.1
IVS-08.1 For your SaaS or PaaS offering, do you provide tenants with separate environments for production and test processes? IVS-08.2 For your IaaS offering, do you provide tenants with guidance on how to create suitable production and test environments?
IVS-08.3 Do you logically and physically segregate production and nonproduction environments? IVS-09.1 Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security IVS-09.2 requirements? Are system and network environments protected by a firewall or virtual firewall to ensure compliance with legislative, regulatory and contractual requirements?
IVS-09.3 Are system and network environments protected by a firewall or virtual firewall to ensure separation of production and nonproduction environments? IVS-09.4 Are system and network environments protected by a firewall or virtual firewall to ensure protection and isolation of sensitive data? IVS-10.1 Are secured and encrypted communication channels used when migrating physical servers, applications or data to virtual servers? IVS-10.2 Do you use a network segregated from production-level networks when migrating physical servers, applications or data to virtual servers?
Infrastructure &
Virtualization Security
VMM Security -
Hypervisor Hardening
IVS-11 IVS-11.1 Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor
authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated communications to the administrative consoles).

Do you restrict personnel access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems based on the principle of least privilege and supported through technical controls (e.g. two-factor authentication, audit trails, IP address filtering, firewalls and TLS-encapsulated communications to the administrative consoles)?
APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.03
DSS06.06
SRM > Privilege
Management
Infrastructure >
Privilege Use
Management -
Hypervisor
Governance and
Compliance
provider X Domain 1,
13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

3.5.1, 3.6.6
IVS-12.1 Are policies and procedures established and mechanisms configured and implemented to protect the wireless network environment perimeter and to restrict unauthorized wireless traffic? IVS-12.2 Are policies and procedures established and mechanisms implemented to ensure wireless security settings are enabled with strong encryption for authentication and transmission, replacing vendor default settings? (e.g., encryption keys, passwords, SNMP community strings)
IVS-12.3 Are policies and procedures established and mechanisms implemented to protect wireless network environments and detect the presence of unauthorized (rogue) network devices for a timely disconnect from the network?
IVS-13.1 Do your network architecture diagrams clearly identify high-risk environments and data flows that may have legal compliance impacts?
IVS-13.2 Do you implement technical measures and apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling and blackholing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denialof-service (DDoS) attacks? Interoperability &
Portability
APIs
IPY-01 IPY-01 The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications.

Do you publish a list of all APIs available in the service and indicate which are standard and which are customized?
- BAI02.04
BAI03.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
Application
Services >
Programming
Interfaces >
provider X Domain 6 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Interoperability &
Portability
Data Request
IPY-02 IPY-02 All structured and unstructured data shall be available to the customer and provided to them upon request in an industrystandard format (e.g., .doc, .xls, .pdf, logs, and flat files) Is unstructured customer data available on request in an industrystandard format (e.g., .doc, .xls, or .pdf)?- APO01.03 APO01.06
APO03.01
APO08.01
APO09.03
DSS04.07
Information
Services >
Reporting
Services >
provider Domain 6 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c) IPY-03.1 Do you provide policies and procedures (i.e. service level agreements) governing the use of APIs for interoperability between your service and third-party applications?

5.0 7.1

7.1.2 7.2

10.1 10.2

10.3 10.4

10.5 10.6

10.7, 10.8

11.4, 11.5, 11.6

12.5.2 10.5.5, 12.10.5

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 1.2.2

1.2.3 1.3

2.2.2 2.2.3

2.2.4 2.5

4.1 6.4.1

6.4.2 1.1

1.2 1.2.1

1.2.3 1.3

1.4 2.1.1

2.2.3 2.2.4

2.3 6.4.1

6.4.2, 7.1

7.1.1 7.1.2

7.1.3 7.1.4

7.2 7.2.2

7.3 12.8

12.2 7.1

7.1.1 7.1.2

7.1.3 7.1.4

7.2 7.1

7.1.1 7.1.2

7.1.3 7.1.4

12.5.4 8.1.4

4.1 1.2.3

2.1.1 4.1

4.1.1 11.1, 11.1.a,

11.1.b, 11.1.c,

11.1.d, 11.1.1,

11.1.2 9.1.3

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 1.2.2

1.2.3 1.3

2.2.2 2.2.3

2.2.4 2.5

4.1 8.1.3

8.1.4 8.1.5, 12.5.4

8.0 10.1,

12.3 BSGP
BSGP
P
GP
PA11
PA12
PA13
PA24
BSGP
SGP
SGP
P
PA16 SGP
PA3
PA5
PA16
PA19
PA18
BSGP
BSGP
SGP
GP
SGP
PA3 BSGP
PA3
PA5
PA16
PA20
BSGP
BSGP
SGP
GP
PA3
PA5
PA16
PA19
PA18
BSGP
BSGP
SGP
GP
SGP
PA3
PA6
PA16
PA20
PA25
PA32
PA33
BSGP
BSGP
SGP
GP
P
BSGP
SGP
PA24 GP

12.2 14.2

17.6 3.3

17.1 17.2

14.5 17.6

18.1 18.4

11.1 17.3

17.1 17.2

9.4 14.1

14.2 19.1

2.2 4.3

3.2 9.2

15.2 9.2

15.2 9.2
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

SHARING WITH THIRD

PARTIES
AP-1 The organization
determines and
documents the legal
authority that permits the
collection, use,
maintenance, and
sharing of personally
identifiable information
(PII), either generally or
in support of a specific
program or information
system need.
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

99.31(a)(1)(ii)

99.3 99.31(a)(1)(ii)
SRM >
Governance Risk
& Compliance >
Vendor
Management
shared x
Information
Services > User
Directory Services
> Active Directory
Services,
LDAP
Repositories,
X.500
Repositories,
DBMS
Repositories,
Meta Directory
Services,
Virtual Directory
Services
shared x
SRM > Policies
and Standards >
Technical Security
Standards
shared x
SRM > Privilege
Management
Infrastructure >
Privilege Usage
Management -
Resource
Protection
shared x
X
SRM >
Infrastructure
Protection
Services >
Network -
Wireless
Protection
provider X
ITOS > Service
Support > Release
Management -
Source Code
Management
shared x
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
APO01.03
APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS05.07
DSS06.03
DSS06.06
APO01.03
APO01.08
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
APO13.01
APO13.02
DSS05.05
APO13.01
APO13.02
BAI10.01
BAI10.02
BAI10.03
DSS01.03
DSS02.01
DSS05.07
DSS06.05
APO08.04
APO13.01
BAI06.01
BAI06.02
BAI10.03
BAI10.04
APO01.03
APO01.08
BAI04.01
BAI04.04
BAI04.05
BAI10.01
BAI10.02
APO01.08
APO13.01
APO13.02
DSS02.02
DSS05.02
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03
DSS06.06
APO03.01
APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06
CC3.1
CC3.3
CC5.3
CC5.1
CC6.2
A1.1
A1.2
CC4.1
CC5.6
CC5.6
CC5.6
CC5.6
CC5.6
CC7.4
IVS-02 The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g. dormant, off, or running). The results of a change or move of an image and the subsequent validation of the image's integrity must be immediately available to customers through electronic methods (e.g. portals or alerts).
45 CFR 164.308
(a)(1)(ii)(D)
45 CFR 164.312
(b)
45 CFR
164.308(a)(5)(ii)
(c) (New)
A.10.10.1
A.10.10.2
A.10.10.3
A.10.10.4
A.10.10.5
A.11.2.2
A.11.5.4
A.11.6.1
A.13.1.1
A.13.2.3
A.15.2.2
A.15.1.3
Commandment #6
Commandment #7
Commandment
#11
CIP-007-3 -
R6.5
AU-1
AU-2
AU-3
AU-4
AU-5
AU-6
AU-7
AU-9
AU-11
AU-12
AU-14
SI-4
PCI DSS v2.0

10.1 PCI DSS
v2.0 10.2

PCI DSS
v2.010.3
PCI DSS v2.0

10.5 PCI DSS
v2.010.6
PCI DSS v2.0

10.7 PCI DSS v2.0

11.4 PCI DSS v2.0

12.5.2 PCI DSS
v2.0 12.9.5
Infrastructure &
Virtualization Security
Change Detection
Infrastructure &
Virtualization Security
Network Architecture
IVS-13 Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks.

Infrastructure &
Virtualization Security
VM Security - vMotion
Data Protection
IVS-10 Secured and encrypted communication channels shall be used when migrating physical servers, applications, or data to virtualized servers and, where possible, shall use a network segregated from production-level networks for such migrations.

PCI DSS v2.0

1.2.3 PCI DSS v2.0

2.1.1 PCI DSS v2.0

4.1 PCI DSS v2.0

4.1.1 PCI DSS
v2.011.1
PCI DSS v2.0

9.1.3 Interoperability &
Portability
Policy & Legal
IPY-03 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage and integrity persistence.

CIP-004-3
R3
AC-4
SC-2
SC-3
SC-7
PCI DSS v2.0

1.1 PCI DSS v2.0

1.2 PCI DSS v2.0

1.2.1 PCI DSS v2.0

1.3 PCI DSS v2.0

1.4 Infrastructure &
Virtualization Security
Wireless Security
IVS-12 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following:
• Perimeter firewalls implemented and configured to restrict unauthorized traffic
• Security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP community strings)
• User access to wireless network devices restricted to authorized personnel
• The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

D.1
B.3
F.1
G.4
G.15
G.17
G.18
E.3.1, F.1.2.4,
F.1.2.5,
F.1.2.6,
F.1.2.8, F.1.2.
9, F.1.2.10,
F.1.2.11,
F.1.2.12,
F.1.2.13,
F.1.2.14,
F.1.2.15,
F.1.2.24,
F.1.3, F.1.4.2,
F1.4.6,
F.1.4.7, F.1.6,
F.1.7,F.1.8,
F.2.13, F.2.14,
F.2.15, F.2.16,
F.2.17, F.2.18
G.9.17, G.9.7,
G.10, G.9.11,
G.14.1, G.15.1,
G.9.2, G.9.3,
G.9.13
40 (B)
44 (C+)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-10 COBIT 4.1 DS5.5
COBIT 4.1 DS5.7
COBIT 4.1 DS5.8
COBIT 4.1 DS5.10
Domain 10 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)

8.2.5 45 CFR 164.312
(e)(1)(2)(ii)
45 CFR
164.308(a)(5)(ii)
(D) (New)
45 CFR
164.312(e)(1)
(New)
45 CFR
164.312(e)(2)(ii)
(New)
A.7.1.1
A.7.1.2
A.7.1.3
A.9.2.1
A.9.2.4
A.10.6.1
A.10.6.2
A.10.8.1
A.10.8.3
A.10.8.5
A.10.10.2
A.11.2.1
A.11.4.3
A.11.4.5
A.11.4.6
A.11.4.7
A.12.3.1
A.12.3.2
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #5
Commandment #9
Commandment
#10
Commandment
#11
CIP-004-3
R3
CIP-007-3 -
R6.1
AC-1
AC-18
CM-6
PE-4
SC-3
SC-7
A.8.1.1
A.8.1.2
A.8.1.3
A.11.2.1
A.11.2.4
A.13.1.1
A.13.1.2
A.13.2.1
A.8.3.3
A.12.4.1
A.9.2.1, A.9.2.2
A.13.1.3
A.10.1.1
A.10.1.2
Infrastructure &
Virtualization Security
Network Security
A.10.1.4
A.10.3.2
A.11.1.1
A.12.5.1
A.12.5.2
A.12.5.3
Commandment #1
Commandment
#10
Commandment
#11
SC-2 PCI DSS v2.0

6.4.1 PCI DSS v2.0

6.4.2 Infrastructure &
Virtualization Security
Segmentation
IVS-09 Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed and
configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations:
• Established policies and procedures
• Isolation of business critical assets and/or sensitive user data and sessions that mandate stronger internal controls and high levels of assurance
• Compliance with legal, statutory and regulatory compliance obligations
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.17 G.9.2, G.9.3,
G.9.13
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-09 COBIT 4.1 DS5.10 Domain 10 6.03.03. (b)

6.03.05. (a)

6.03.05. (b)

6.04.01. (a)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)

6.04.08.02. (b)

6.05. (c)
Article 17 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 AC-4 NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
45 CFR 164.308
(a)(4)(ii)(A)
A.11.4.5
A.11.6.1
A.11.6.2
A.15.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment
#10
Commandment
#11
Infrastructure &
Virtualization Security
Production /
Nonproduction
Environments
IVS-08 Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets.

Separation of the environments may include: stateful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.

S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

B.1 I.2.7.1, I.2.20,
I.2.17,
I.2.22.2,
I.2.22.4,
I.2.22.10-14,
H.1.1
22 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-06 COBIT 4.1 DS5.7 Information Domain 10 6.03. (d) NIST SP 800-53 R3 SC-2 1.2.6 Services > Data
Governance >
Data Segregation
APO03.01 shared x
APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and 312.10
SA-4
IVS-06 Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections, these configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, and ports, and compensating controls.

S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.2
G.4
G.15
G.16
G.17
G.18
I.3
G.9.17, G.9.7,
G.10, G.9.11,
G.14.1, G.15.1,
G.9.2, G.9.3,
G.9.13
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-08 Domain 10 6.03.03. (a)

6.03.03. (d)

6.03.04. (d)

6.04.07. (a)

6.07.01. (c)
Article 17 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20
(1)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32

8.2.5 A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment
#10
Commandment
#11
CIP-004-3
R2.2.4
SC-7 PCI DSS v2.0

1.1 PCI DSS v2.0

1.1.2 PCI DSS v2.0

1.1.3 PCI DSS v2.0

1.1.5 PCI DSS v2.0

1.1.6 PCI DSS v2.0

1.2 PCI DSS v2.0

1.2.1 PCI DSS v2.0

2.2.2, PCI DSS
v2.0 2.2.3
A.10.3.1 Commandment #1
Commandment #2
Commandment #3
Infrastructure &
Virtualization Security
Capacity / Resource
Planning
IVS-04 The av ailability , quality , and adequate capacity and resources shall be planned, prepared, and measured to deliv er the required sy stem perf ormance in accordance with legal, statutory , and regulatory compliance obligations. Projections of f uture capacity requirements shall be made to mitigate the risk of sy stem ov erload.

A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats
have been implemented consistent with the risk
assessment when commercially practicable.
(A4.1.0) The entity’s system availability and
security performance is periodically reviewed and
compared with the defined system availability and
related security policies.

G.5 OP-03 COBIT 4.1 DS 3 Domain 7,
8 6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

6.03.07. (d)
Article 17 (1) NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
312.8 and 312.10 ITOS > Service 1.2.4
Delivery >
Information
Technology
Resiliency -
Capacity Planning
provider x
PCI DSS v2.0

7.1.2 Infrastructure &
Virtualization Security
Audit Logging /
Intrusion Detection
IVS-01 Higher levels of assurance are required for protection, retention, and lifecyle management of audit logs, adhering to applicable legal, statutory or regulatory compliance obligations and providing unique user access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic investigative capabilities in the event of a security breach.

S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other
incidents.

G.7
G.8
G.9
J.1
L.2
G.14.7, G.14.8,
G.14.9,
G.14.10,G.14.1
1, G.14.12,
G.15.5, G.15.7,
G.15.8, G.16.8,
G.16.9,
G.16.10,
G.15.9, G.17.5,
G.17.7, G.17.8,
G.17.6, G.17.9,
G.18.2, G.18.3,
G.18.5, G.18.6,
G.19.2.6,
G.19.3.1,
G.9.6.2,
G.9.6.3,
G.9.6.4,
G.9.19, H.2.16,
H.3.3, J.1, J.2,
L.5, L.9, L.10
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-14 COBIT 4.1 DS5.5
COBIT 4.1 DS5.6
COBIT 4.1 DS9.2
Domain 10 6.03. (i)

6.03. (j)

6.03.03. (a)

6.03.03. (d)

6.03.04. (e)

6.04.07. (a)

6.07.01. (a)

6.07.01. (c)
Article 17 NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-3
NIST SP 800-53 R3 AU-4
NIST SP 800-53 R3 AU-5
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 AU-12
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-8 (1)

8.2.1 8.2.2
312.8 and 312.10
312.3, 312.8 and
312.10
BOSS > Security
Monitoring
Services > SIEM
shared x
Identity & Access
Management
Utility Programs Access
IAM13Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted.

S3.2.g (S3.2.g) g. Restriction of access to system
configurations, superuser functionality, master
passwords, powerful utilities, and security devices
(for example, firewalls).

H.2.16 Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-34 COBIT 4.1 DS5.7 Domain 2 NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
CIP-004-3
R2.2.3
CIP-007-3 -
R5.1.3 -
R5.2.1 -
R5.2.3
AC-2
PS-4
PS-5
A.11.4.1
A 11.4.4
A.11.5.4
Commandment #1
Commandment #5
Commandment #6
Commandment #7
CIP-007-3 -
R2.1 -
R2.2 -
R2.3
AC-5
AC-6
CM-7
SC-3
SC-19
PCI DSS v2.0

8.5.4 PCI DSS v2.0

8.5.5 Identity & Access
Management
User ID Credentials
IAM12Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures:
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
• Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets) S3.2.b (S3.2.b) b. Identification and authentication of users.

B.1
H.5
E.6.2, E.6.3,
H.1.1, H.1.2,
H.2, H.3.2,
H.4, H.4.1,
H.4.5, H.4.8
6 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-02 COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
Domain 10 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.04.05. (b)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2
(1)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 AC-11 (1)
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-2 (3)
NIST SP 800-53 R3 AU-2 (4)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 SC-10
45 CFR
164.308(a)(5)(ii)
(c) (New)
45 CFR 164.308
(a)(5)(ii)(D)
45 CFR 164.312
(a)(2)(i)
45 CFR 164.312
(a)(2)(iii)
45 CFR 164.312
(d)
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.3
A.11.2.4
A.11.5.5
Commandment #6
Commandment #7
Commandment #8
Commandment #9
CIP-004-3
R2.2.3
CIP-007-3 -
R5.2 -
R5.3.1 -
R5.3.2 -
R5.3.3
AC-1
AC-2
AC-3
AC-11
AU-2
AU-11
IA-1
IA-2
IA-5
IA-6
IA-8
SC-10
PCI DSS v2.0

8.1 PCI DSS v2.0

8.2,
PCI DSS v2.0

8.3 PCI DSS v2.0

8.4 PCI DSS v2.0

8.5 PCI DSS v2.0

10.1,
PCI DSS v2.0

12.2,
PCI DSS v2.0

12.3.8 SRM > Privilege
Management
Infrastructure >
Identity
Management -
Identity
Provisioning
shared x 9.2

15.1 15.2
PA9
PA6
PA24
PA22

8.2.1 8.2.7
45 CFR 164.308
(a)(3)(ii)(B)
45 CFR 164.308
(a)(4)(ii)(C)
A.11.2.4 Commandment #6
Commandment #7
Commandment #8
Commandment
#10
CIP-004-3
R2.2.2
CIP-007-3 -
R5 - R.1.3
AC-2
AU-6
PM-10
PS-6
PS-7
Identity & Access
Management
User Access Revocation
IAM11Timely de-provisioning (revocation or modification) of user access to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components, shall be implemented as per established policies and procedures and based on user's change in status (e.g., termination of employment or other business relationship, job change or transfer). Upon request, provider shall inform customer (tenant) of these changes, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to,
the following matters:
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).

H.2 E.6.2, E.6.3 Schedule 1
(Section 5), 4.7 -
Safeguards
IS-09 COBIT 4.1 DS 5.4 Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

6.04.02. (b)
Article 17 NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 SC-30

8.2.1 45 CFR
164.308(a)(3)(ii)
(C)

ISO/IEC
27001:2005
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.2
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
User Access
Authorization
IAM09Provisioning user access (e.g., employees, contractors, customers (tenants), business partners and/or supplier relationships) to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components shall be authorized by the organization's management prior to access being granted and appropriately restricted as per established policies and procedures. Upon request, provider shall inform customer (tenant) of this user access, especially if customer (tenant) data is used as part of the service and/or customer (tenant) has some shared responsibility over implementation of control.

Identity & Access
Management
User Access Reviews
IAM10User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access violations, remediation must follow established user access policies and procedures.

H.2.6, H.2.7,
H.2.9,
41 (B) Schedule 1
(Section 5), 4.7 -
Safeguards
IS-10 COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
45 CFR 164.308
(a)(3)(i)
45 CFR 164.308
(a)(3)(ii)(A)
45 CFR 164.308
(a)(4)(i)
45 CFR 164.308
(a)(4)(ii)(B)
45 CFR 164.308
(a)(4)(ii)(C)
45 CFR 164.312
(a)(1)
A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1
Identity & Access
Management
User Access Restriction
/ Authorization
IAM08Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary.

IS-08
IS-12
COBIT 4.1 DS5.4 Domain 12
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
NIST SP800-53 R3 AC-3
NIST SP800-53 R3 AC-5
NIST SP800-53 R3 AC-6
NIST SP800-53 R3 IA-2
NIST SP800-53 R3 IA-4
NIST SP800-53 R3 IA-5
NIST SP800-53 R3 IA-8
NIST SP800-53 R3 MA-5
NIST SP800-53 R3 PS-6
NIST SP800-53 R3 SA-7
NIST SP800-53 R3 SI-9
PCI DSS v2.0

7.1 PCI DSS v2.0

7.1.1 PCI DSS v2.0

7.1.2 PCI DSS v2.0

7.1.3 PCI DSS v2.0

7.2.1 PCI DSS v2.0

7.2.2 PCI DSS v2.0

8.5.1 PCI DSS v2.0

12.5.4 "FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

H.2.4, H.2.5, 35 (B)
40 (B)
41 (B)
42 (B)
44 (C+)
Schedule 1
(Section 5)
Safeguards, Subs.

4.7.2 and 4.7.3
IS-08 DS5.4 Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

6.03.06. (b)

6.04.01. (a)

6.04.01. (b)

6.04.01. (d)

6.04.01. (e)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)
APO01.03 Article 17
APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
SRM > Privilege
Management
Infrastructure >
Identity
Management -
Identity
Provisioning
shared x
SRM > Privilege
Management
Infrastructure >
Authorization
Services -
Entitlement
Review
shared x NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
S3.2.0
S4.3.0
(S3.2.0) Procedures exist to restrict logical access
to the defined system including, but not limited to,
the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).
(S4.3.0) Environmental, regulatory, and
technological changes are monitored, and their
effect on system availability, confidentiality,
processing integrity and security is assessed on a
timely basis; policies are updated for that
assessment.

Clause 4.3.3
A.12.4.3
A.15.1.3
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #6
Commandment #7
Commandment #9
Commandment
#10
CM-5
CM-6
PCI-DSS v2.0

6.4.1 PCI-DSS v2.0

6.4.2 Identity & Access
Management
Third Party Access
IAM07The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access.

Compensating controls derived from the risk analysis shall be implemented prior to provisioning access.

S3.1
x3.1.0
(S3.1) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system [availability, processing
integrity, confidenitality] commitments and (2)
assess the risks associated with the identified
threats.

B.1
H.2
B.1.1, B.1.2,
D.1.1, E.1,
F.1.1, H.1.1,
K.1.1, E.6.2,
E.6.3
Schedule 1
(Section 5), 4.7 -
Safeguards
RI-05 COBIT 4.1 DS 2.3 Domain 2,
4 6.02. (a)

6.02. (b)

6.03. (a)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

7.1.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4
A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4
CA-3
MA-4
RA-3
PCI DSS v2.0

12.8.1 PCI DSS v2.0

12.8.2 PCI DSS v2.0

12.8.3 PCI DSS v2.0

12.8.4 Identity & Access
Management
Source Code Access
Restriction
IAM06Access to the organization's own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures.

S3.13.0 (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are
made to the system.

I.2.7.2, I.2.9,
I.2.10, I.2.15
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-33 Domain 2 Article 17 NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)

1.2.6 6.2.1
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.2
G.4
G.15
G.16
G.17
G.18
I.3
G.9.17, G.9.7,
G.10, G.9.11,
G.14.1, G.15.1,
G.9.2, G.9.3,
G.9.13
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-08 Domain 10 6.03.03. (a)

6.03.03. (d)

6.03.04. (d)

6.04.07. (a)

6.07.01. ©
Article 17 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20
(1)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32

8.2.5 6.04.03. (b)

6.04.08. (a)

6.04.08. (b)

6.06. (a)

6.06. (b)

6.06. (c)

6.06. (d)

6.06. (e)

6.06. (f)
APO01.08 provider Domain 3
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
SRM >
Infrastructure
Protection
Services >
Network
provider x
Information
Technology
Operation
Services > Service
Delivery > Service
Level
Management -
External SLA's
A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2
(1)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7

7.1 7.1.1

7.1.2 7.1.3

7.2.1 7.2.2

8.5.1 12.5.4
AC-3
AC-5
AC-6
IA-2
IA-4
IA-5
IA-8
MA-5
PS-6
SA-7
SI-9
CIP-003-3 -
R5.1.1 -
R5.3
CIP-004-3
R2.3
CIP-007-3
R5.1 -
R5.1.2
A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1
45 CFR 164.308
(a)(3)(i)
45 CFR 164.308
(a)(3)(ii)(A)
45 CFR 164.308
(a)(4)(i)
45 CFR 164.308
(a)(4)(ii)(B)
45 CFR 164.308
(a)(4)(ii)(C)
45 CFR 164.312
(a)(1)
NIST SP 800-53 R3 AC-3 8.2.2
NIST SP 800-53 R3 AC-3 (3)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SC-30
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment
#10
Commandment
#11
A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4
A.12.1.4
A.14.2.9
A.9.1.1

8.1,partial,
A.14.2.2

8.1,partial,
A.14.2.3

8.1,partial,
A.14.2.4
A.13.1.3
A.9.4.1
A.18.1.4
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),
CIP-004-3
R2.2.4

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 2.2.2

2.2.3 Clause

5.2(c)

5.3(a),

5.3(b),

7.5.3(b)

7.5.3(d)

8.1,

8.3 9.2(g)
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.5
Annex
A.9.2,
A.9.2.1,
A.9.2.2,
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6,
A.9.3.1,
A.9.4.1,
A.9.4.2,
A.9.4.3,
A.9.4.5
A.9.2.1, A.9.2.2
A.9.2.3
A.9.1.2
A.9.4.1
A.9.2.5
Annex A
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.3
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.4
A.9.2.5
A.9.4.2
A.9.1.2
Deleted
A.9.4.4
A.12.4.1
A.12.4.1
A.12.4.2,
A.12.4.3
A.12.4.3
A.12.4.1
A.9.2.3
A.9.4.4
A.9.4.1
A.16.1.2
A.16.1.7
A.18.2.3
A.18.1.3
Annex
A.12.1.2
A.12.4,
A.12.4.1,
A.12.4.2,
A.12.4.3,
A.12.6.1,
A.12.6.2,
A.16.1.1,
A.16.1.2,
A.16.1.3,
A.16.1.4,
A.16.1.5,
A.16.1.6,
A.12.1.3
SRM > Privilege
Management
Infrastructure >
Privileged Usage
Management ->
Hypervisor
Governance and
Compliance
PA35 GP
Domain 1,
13 APO03.01
APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06
APO03.01
APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
APO03.01
APO03.02
APO03.04
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and 312.10
312.8 and 312.10
SRM >
Infrastructure
Protection
Services >
Network
provider x
SRM >
Infrastructure
Protection
Services >
Network -
Firewall
provider x
SRM >
Cryptographic
Services > Data-intransit Encryption
provider
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),
A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4
-
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 87
#2..
- 131 -
IPY-03.2 Do you provide policies and procedures (i.e. service level agreements) governing the migration of application data to and from your service?
IPY-04.1 Can data import, data export and service management be conducted over secure (e.g., non-clear text and authenticated), industry accepted standardized network protocols?
IPY-04.2 Do you provide consumers (tenants) with documentation detailing the relevant interoperability and portability network protocol standards that are involved?
IPY-05.1 Do you use an industry-recognized virtualization platform and standard virtualization formats (e,g., OVF) to help ensure interoperability?
IPY-05.2 Do you have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks available for customer review?
Mobile Security
Anti-Malware
MOS01MOS-01 Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training.

Do you provide anti-malware training specific to mobile devices as part of your information security awareness training?
- APO01.03
APO13.01
APO07.03
APO07.06
APO09.03
SRM >
Governance Risk
& Compliance >
Technical
Awareness and
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1) Mobile Security
Application Stores
MOS02MOS-02 A documented list of approved application stores has been communicated as acceptable for mobile devices accessing or storing provider managed data.

Do you document and make available lists of approved application stores for mobile devices accessing or storing company data and/or company systems?
- APO01.04
APO01.08
APO04.02
APO13.01
APO13.02
APO13.03
SRM > Policies
and Standards >
Technical
Securitry
Standards
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

4.1.1 Mobile Security
Approved Applications
MOS03MOS-03 The company shall have a documented policy prohibiting the installation of non-approved applications or approved applications not obtained through a pre-identified application store.

Do you have a policy enforcement capability (e.g., XACML) to ensure that only approved applications and those from approved application stores be loaded onto a mobile device?
- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
ITOS > Service
Support >
Configuration
Management -
Software
Management
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Mobile Security
Approved Software for
BYOD
MOS04MOS-04 The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage.

Does your BYOD policy and training clearly state which applications and applications stores are approved for use on BYOD devices? - APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM > Policies
and Standards >
Technical
Securitry
Standards
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Mobile Security 6.1.2(b)
Awareness and
Training
MOS05MOS-05 The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices. The provider shall post and communicate the policy and requirements through the company's security awareness and training program.

Do you have a documented mobile device policy in your employee training that clearly defines mobile devices and the accepted usage and requirements for mobile devices?
- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM > Policies
and Standards >
Technical
Securitry
Standards
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

4.3 Mobile Security
Cloud Based Services
MOS06MOS-06 All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.

Do you have a documented list of pre-approved cloud based services that are allowed to be used for use and storage of company business data via a mobile device?
- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM >
Governance Risk
& Compliance >
Vendor
Management
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Mobile Security
Compatibility
MOS07MOS-07 The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues.

Do you have a documented application validation process for testing device, operating system and application compatibility issues? - APO01.03
APO01.08
APO13.01
APO13.02
BAI03.07
BAI03.08
ITOS > Service
Support >
Configuration
Management -
Software
Management
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Device Eligibility
MOS08MOS-08 The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage.

Do you have a BYOD policy that defines the device(s) and eligibility requirements allowed for BYOD usage?
- APO01.03
APO01.08
APO13.01
APO13.02
BAI02.01
SRM > Policies
and Standards >
Information
Security Policies
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security
Device Inventory
MOS09MOS-09 An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices, (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD), will be included for each device in the inventory.

Do you maintain an inventory of all mobile devices storing and accessing company data which includes device status (os system and patch levels, lost or decommissioned, device assignee)? - BAI06.01
BAI06.02
BAI06.04
BAI10.01
BAI10.02
BAI10.03
SRM >
Infrastructure
Protection
Services > End
Point - Inventory
Control
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),
Mobile Security 6.1.2(c)(2)
Device Management
MOS10MOS-10 A centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data.

Do you have a centralized mobile device management solution deployed to all mobile devices that are permitted to store, transmit, or process company data?
- APO03.01
APO03.02
APO04.02
APO13.01
APO13.02
BAI02.01
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
Devices-Mobile
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Encryption
MOS11MOS-11 The mobile device policy shall require the use of encryption either for the entire device or for data identified as sensitive on all mobile devices and shall be enforced through technology controls.

Does your mobile device policy require the use of encryption for either the entire device or for data identified as sensitive enforceable through technology controls for all mobile devices?
- APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS06.06
SRM > Data
Protection >
Cryptographic
Services - Data-AtRest Encryption
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
PA32 BSGP 4.1
MOS12.1Does your mobile device policy prohibit the circumvention of built-in security controls on mobile devices (e.g., jailbreaking or rooting)? MOS12.2Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls?
MOS13.1Does your BYOD policy clearly define the expectation of privacy, requirements for litigation, e-discovery and legal holds? MOS13.2Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls?
Mobile Security
Lockout Screen
MOS14MOS-14 BYOD and/or company owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls.

Do you require and enforce via technical controls an automatic lockout screen for BYOD and company owned devices?
- DSS05.03
DSS05.05
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
sharedX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security
Operating Systems
MOS15MOS-15 Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes.

Do you manage all changes to mobile device operating systems, patch levels and applications via your company's change management processes?
- APO01.03
APO13.01
APO13.02
BAI06
ITOS > Service
Support -Change
Management >
Planned Changes
sharedX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
MOS- 6.1.2(a)(2),

16.1 Do you have password policies for enterprise issued mobile devices and/or BYOD mobile devices?
MOS16.2Are your password policies enforced through technical controls (i.e.

MDM)?
MOS16.3Do your password policies prohibit the changing of authentication requirements (i.e. password/PIN length) via a mobile device? MOS17.1Do you have a policy that requires BYOD users to perform backups of specified corporate data?
MOS17.2Do you have a policy that requires BYOD users to prohibit the usage of unapproved application stores?
MOS17.3Do you have a policy that requires BYOD users to use anti-malware software (where supported)?
MOS18.1Does your IT provide remote wipe or corporate data wipe for all company-accepted BYOD devices?
MOS18.2Does your IT provide remote wipe or corporate data wipe for all company-assigned mobile devices?
MOS19.1Do your mobile devices have the latest available security-related patches installed upon general release by the device manufacturer or carrier?
MOS19.2Do your mobile devices allow for remote validation to download the latest security patches by company IT personnel?
MOS20.1Does your BYOD policy clarify the systems and servers allowed for use or access on the BYOD-enabled device?
MOS20.2Does your BYOD policy specify the user roles that are allowed access via a BYOD-enabled device?
Security Incident
Management, EDiscovery & Cloud
Forensics
Contact / Authority
Maintenance
SEF-01 SEF-01.1 Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impactedscope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement.

Do you maintain liaisons and points of contact with local authorities in accordance with contracts and appropriate regulations? CC3.3 APO01.01
APO01.02
APO01.03
APO01.08
MEA03.01
MEA03.02
MEA03.03
312.4 BOSS >
Compliance >
Contact/Authority
Maintenance
sharedx A.6.1.6
A.6.1.7
A.6.1.3
A.6.1.4
Chapter VI,
Article 44.

Chapter II,
Article 16, part I

3.2 12.5.3

12.10.1 SEF-02.1 Do you have a documented security incident response plan? SEF-02.2 Do you integrate customized tenant requirements into your security incident response plans?
SEF-02.3 Do you publish a roles and responsibilities document specifying what you vs. your tenants are responsible for during security incidents? SEF-02.4 Have you tested your security incident response plans in the last year?
SEF-03.1 Does your security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting? SEF-03.2 Does your logging and monitoring framework allow isolation of an incident to specific tenants?
SEF-04.1 Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?
SEF-04.2 Does your incident response capability include the use of legally admissible forensic data collection and analysis techniques? SEF-04.3 Are you capable of supporting litigation holds (freeze of data from a specific point in time) for a specific tenant without freezing other tenant data?
SEF-04.4 Do you enforce and attest to tenant data separation when producing data in response to legal subpoenas?
SEF-05.1 Do you monitor and quantify the types, volumes and impacts on all information security incidents?

4.1 12.1

12.10.1 PA8
PA11
BSGP
PA8 BSGP
SGP

4.1 4.2

4.6 7.1

7.2 7.3

7.2 7.3
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE

99.31(a)(1)(i)
34 CFR 99.32(a)
BOSS >
Operational Risk
Management >
Key Risk
Indicators
sharedx
Infrastructure
Services > Virtual
Infrastructure >
Server
Virtualization
providerXX
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
Devices-Mobile
Device
Management
sharedX
SRM >
Infrastructure
Protection
Services-
>Network > Link
Layer Network
Security
sharedX
SRM > Policies
and Standards >
Technical Security
Standards
sharedX
ITOS > Service
Support >
Security Incident
Management
sharedx
shared
sharedX
SRM > Data
Protection >
Cryptographic
Services - Data-InTransit Encryption
providerx
312.8 and 312.10
312.3, 312.8 and
312.10
312.8 and 312.10
312.8 and 312.10
APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
APO01.03
APO13.01
APO13.02
DSS05.03
APO01.03
APO13.01
APO13.02
CC5.5
CC6.2
CC2.3
CC2.5
C1.4
C1.5
CC2.5
CC6.2
CC6.2
CC4.1
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Metrics
SEF-05 Domain 2 6.07.01. (a)

6.07.01. (i)
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8

1.2.7 1.2.10
IR-2
IR-6
IR-7
SI-4
SI-5
45 CFR 164.308
(a)(1)(ii)(D)
A.13.2.2 CIP-008-3 -
R1.1
IR-4
IR-5
IR-8
PCI DSS v2.0

12.9.6 APO01.03
APO07.06
APO07.03
APO13.01
APO13.02
DSS02.01
APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
DSS04.07
PA11 BSGP
PA11 BSGP
PCI-DSS v2.0

12.5.2 PCI-DSS v2.0

12.5.3 Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Legal Preparation
SEF-04 Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation.

S2.4.0
C3.15.0
(S2.4.0) The process for informing the entity about
system availability issues, confidentiality issues,
processing integrity issues, security issues and
breaches of the system security and for submitting
complaints is communicated to authorized users.
(C3.15.0) Procedures exist to provide that issues of
noncompliance with defined confidentiality and
related security policies are promptly addressed
and that corrective measures are taken on a
timely basis.

J.1
E.1
J.1.1, J.1.2,
E.4
IS-24 COBIT 4.1 DS5.6 Domain 2 6.04.07. (b)

6.07.01. (f)

6.07.01. (h)
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 AU-7
NIST SP 800-53 R3 AU-7 (1)
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2)
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 MP-5
NIST SP 800-53 R3 MP-5 (2)
NIST SP 800-53 R3 MP-5 (4)

1.2.7 45 CFR 164.308
(a)(6)(ii)
Clause 4.3.3
Clause 5.2.2
A.8.2.2
A.8.2.3
A.13.2.3
A.15.1.3
BOSS > Legal
Services >
Incident
Response Legal
Preparation
sharedx CIP-004-3
R3.3
AU-6
AU-7
AU-9
AU-11
IR-5
IR-7
IR-8
BOSS > Human
Resources
Security >
Employee
Awareness
sharedx
Commandment #2
Commandment #6
Commandment #8
Chapter II, Article 20 CIP-007-3 -
R6.1
CIP-008-3 -
R1
IR-1
IR-2
IR-3
IR-4
IR-5
IR-7
IR-8
PCI-DSS v2.0

12.9 PCI-DSS v2.0

12.9.1 PCI-DSS v2.0

12.9.2 PCI-DSS v2.0

12.9.3 PCI-DSS v2.0

12.9.4 PCI-DSS v2.0

12.9.5 PCI-DSS v2.0

12.9.6 Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Reporting
SEF-03 Workforce personnel and external business relationships shall be informed of their responsibility and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations.

A2.3.0
C2.3.0
I2.3.0
S2.3.0
S2.4
(A2.3.0, C2.3.0, I2.3.0, S2.3.0) Responsibility and
accountability for the entity’s system availability,
confidentiality of data, processing integrity and
related security policies and changes and updates
to those policies are communicated to entity
personnel responsible for implementing them.
(S2.4) The process for informing the entity about
breaches of the system security and for submitting
J.1
E.1
J.1.1, E.4 5 (B)
46 (B)
48 (A+)
49 (B)
50 (B)
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.3
IS-23 COBIT 4.1 DS5.6 Domain 2 6.07.01. (a) Article 17 NIST SP 800-53 R3 IR-2 NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-6 (1)
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)

1.2.7 1.2.10

7.1.2 7.2.2

7.2.4 10.2.4
45 CFR 164.312
(a)(6)(ii)
16 CFR 318.3 (a)
(New)
16 CFR 318.5 (a)
(New)
45 CFR 160.410
(a)(1) (New)
Clause 4.3.3
Clause 5.2.2
A.6.1.3
A.8.2.1
A.8.2.2
A.13.1.1
A.13.1.2
A.13.2.1
ITAR 22
CFR §
127.12
Commandment #2
Commandment #6
Commandment #8
Chapter II, Article 20 CIP-003-3 -
R4.1
CIP-004-3
R3.3
IS3.7.0
S3.9.0
(IS3.7.0) Procedures exist to identify, report, and
act upon system security breaches and other
incidents.
(S3.9.0) Procedures exist to provide that issues of
noncompliance with system availability,
confidentiality of data, processing integrity and
related security policies are promptly addressed
and that corrective measures are taken on a
timely basis.

J.1 J.1.1, J.1.2 1.2.4

1.2.7 7.1.2

7.2.2 7.2.4

10.2.1 10.2.4
45 CFR 164.308
(a)(1)(i)
45 CFR 164.308
(a)(6)(i)
Clause 4.3.3
A.13.1.1
A.13.2.1
ITAR 22
CFR §
127.12
Mobile Security
Passwords
MOS16Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/PIN lengths and authentication requirements.

Mobile Security
Policy
MOS17The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported).

Mobile Security
Remote Wipe
MOS18All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's corporate IT.

Mobile Security
Security Patches
MOS19Mobile devices connecting to corporate networks or storing and accessing company information shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these updates remotely.

Mobile Security
Users
MOS20The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device.

Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Management
SEF-02 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures.

APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.03
APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06
APO01.03
APO13.01
APO13.02
APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
Interoperability &
Portability
Policy & Legal
IPY-03 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage and integrity persistence.

Interoperability &
Portability
Standardized Network
Protocols
IPY-04 The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.

Interoperability &
Portability
Virtualization
IPY-05 The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks, available for customer review.

Mobile Security
Jailbreaking and
Rooting
MOS12The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g. jailbreaking or rooting) and isenforced through detective and preventative controls on the device or through a centralized device management system (e.g. mobile device management).

Mobile Security
Legal
MOS13The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds.

The BYOD policy shall clearly state the expectations over the loss of non-company data in the case a wipe of the device is required.

IS-25 - Domain 6
46 (B) Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4; 4.8
Openness, Subs.

4.8.2 IS-22 COBIT 4.1 DS5.6 Domain 2 6.04.07. (b)

6.07.01. (a)

6.07.01. (d)

6.07.01. (e)

6.07.01. (f)

6.07.01. (g)

6.07.01. (h)
Article 17 NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-3
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 IR-8
Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

S3.9.0
C4.1.0
(S3.9.0) Procedures exist to provide that issues of
noncompliance with security policies are promptly
addressed and that corrective measures are taken
on a timely basis.
(C4.1.0) The entity’s system security, availability,
system integrity, and confidentiality is periodically
reviewed and compared with the defined system
security, availability, system integrity, and
confidentiality policies.

J.1.2 47 (B) COBIT 4.1 DS 4.9 - None
(Mobile
Guidance)
- Domain 6
None
(Mobile
Guidance)
BOSS > Data
Governance >
Secure Disposal
of Data
- None
(Mobile
Guidance)
APO01.03
APO13.01
APO13.02
DSS05.03
- None
(Mobile
Guidance)
APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06
PA34
SRM > Policies
and Standards >
Technical Security
Standards
sharedX
None
(Mobile
Guidance)
None
(Mobile
Guidance)
- None
(Mobile
Guidance)
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
Devices-Mobile
Device
Management
providerX
SRM > Policies
and Standards >
Information
Security Services

6.04.03. (b)

6.04.08. (a)

6.04.08. (b)

6.06. (a)

6.06. (b)

6.06. (c)

6.06. (d)

6.06. (e)

6.06. (f)
APO01.08 provider Domain 3
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
Information
Technology
Operation
Services > Service
Delivery > Service
Level
Management -
External SLA's
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
-
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)
Clause

5.3 (a),

5.3 (b),

7.5.3(b),

5.2 (c),

7.5.3(d),

8.1,

8.3,

9.2(g),
Annex
A.16.1.1
A.16.1.2
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),

7.3(c)

7.5.3(b),

7.5.3(d),

8.1,

8.3,

9.2(g)
Annex
A.7.2.2,
A.7.2.3,
A.16.1.7,
A.16.1.6
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 88
#2..
- 132 -
SEF-05.2 Will you share statistical information for security incident data with your tenants upon request?
STA-01.1 Do you inspect and account for data quality errors and associated risks, and work with your cloud supply-chain partners to correct them?
STA-01.2 Do you design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privileged access for all personnel within your supply chain?
Supply Chain
Management,
Transparency and
Accountability
Incident Reporting
STA02STA-02.1 The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals).

Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals)?
APO09.03
APO09.04
APO10.04
APO10.05
DSS02.07
ITOS > Service
Support ->
Incident
Management >
Cross Cloud
Incident
Response
prov ider Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
STA-03.1 Do you collect capacity and use data for all relevant components of 6.1.2(b) your cloud service offering?
STA-03.2 Do you provide tenants with capacity planning and use reports? Supply Chain
Management,
Transparency and
Accountability
Provider Internal
Assessments
STA04STA-04.1 The provider shall perform annual internal assessments of conformance and effectiveness of its policies, procedures, and supporting measures and metrics.

Do you perform annual internal assessments of conformance and effectiveness of your policies, procedures, and supporting measures and metrics?
MEA01
MEA02
SRM >
Governance Risk
& Compliance >
Vendor
Management
provider x Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

12.1.1 STA-05.1 Do you select and monitor outsourced providers in compliance with laws in the country where the data is processed, stored and transmitted?
STA-05.2 Do you select and monitor outsourced providers in compliance with laws in the country where the data originates?
STA-05.3 Does legal counsel review all third-party agreements? STA-05.4 Do third-party agreements include provision for the security and protection of information and assets?
STA-05.5 Do you provide the client with a list and copies of all subprocessing agreements and keep this updated?
Supply Chain
Management,
Transparency and
Accountability
Supply Chain
Governance Reviews
STA06STA-06.1 Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain.

Do you review the risk management and governanced processes of partners to account for risks inherited from other members of that partner's supply chain?
APO10.04
APO10.05
MEA01
SRM >
Governance Risk
& Compliance >
Vendor
Management
provider x Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

12.8.4 STA-07.1 Are policies and procedures established, and supporting business processes and technical measures implemented, for maintaining complete, accurate and relevant agreements (e.g., SLAs) between providers and customers (tenants)?
STA-07.2 Do you have the ability to measure and address non-conformance of provisions and/or terms across the entire supply chain
(upstream/downstream)?
STA-07.3 Can you manage service-level conflicts or inconsistencies resulting from disparate supplier relationships?
STA-07.4 Do you review all agreements, policies and processes at least annually?
Supply Chain
Management,
Transparency and
Accountability
Third Party Assessment
STA08STA-08.1 Providers shall assure reasonable information security across their information supply chain by performing an annual review. The review shall include all partners/third party providers upon which their information supply chain depends on.

Do you assure reasonable information security across your information supply chain by performing an annual review? STA-8.2 Does your annual review include all partners/third-party providers upon which your information supply chain depends?
STA-09.1 Do you permit tenants to perform independent vulnerability assessments?
STA-09.2 Do you have external third party services conduct vulnerability scans and periodic penetration tests on your applications and networks? TVM01.1Do you have anti-malware programs that support or connect to your cloud service offerings installed on all of your systems? TVM01.2Do you ensure that security threat detection systems using signatures, lists or behavioral patterns are updated across all infrastructure components within industry accepted time frames? TVM02.1Do you conduct network-layer vulnerability scans regularly as prescribed by industry best practices?
TVM02.2Do you conduct application-layer vulnerability scans regularly as prescribed by industry best practices?
TVM02.3Do you conduct local operating system-layer vulnerability scans regularly as prescribed by industry best practices?
TVM02.4Will you make the results of vulnerability scans available to tenants at their request?
TVM02.5Do you have a capability to rapidly patch vulnerabilities across all of your computing devices, applications and systems?
TVM02.6Will you provide your risk-based systems patching time frames to your tenants upon request?
TVM03.1Is mobile code authorized before its installation and use, and the code configuration checked, to ensure that the authorized mobile code operates according to a clearly defined security policy? TVM03.2Is all unauthorized mobile code prevented from executing?

2.4 12.8.2

12.8.3 12.8.4
Appendix A

1.4, 5.0

2.2 6.1

6.2 6.3.2

6.4.5 6.5

6.6 11.2

11.2.1 11.2.2

11.2.3 PA2
PA8
BSGP
PA3
PA8
PA16
BSGP
BSGP
SGP
PA1 BSGP

7.2 7.3

17.1 5.2

2.2 5.4

14.1 17.6

12.4 14.1
3 3.1

3.2 3.3

3.4 3.5
BOSS >
Compliance >
Third-Party Audits
shared x
SRM >
Infrastructure
Protection
Services > AntiVirus
shared x
SRM > Threat and
Vulnerability
Management >
Vulnerability
Management
shared x
SRM >
Infrastructure
Protection
Services > End
Point - White
Listing
shared x
BOSS >
Operational Risk
Management >
Key Risk
Indicators
shared x
SRM >
Governance Risk
& Compliance >
Vendor
Management
prov ider X
provider x
BOSS > Legal
Services >
Contracts
shared x
ITOS > Service
Delivery > Service
Level
Management -
Vendor
Management
provider x
SRM >
Governance Risk
& Compliance >
Vendor
Management
provider x
312.8 and 312.10
312.8 and 312.10
312.2(a) and
312.3 (Prohibition
on Disclosure)
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
APO01.03
APO09.03
APO09.04
APO09.05
APO10.01
APO10.03
APO10.04
APO09.03
MEA01
MEA02
APO01.08
APO10.05
MEA02.01
APO01.03
APO13.01
APO13.02
DSS05.01
APO01.03
APO13.01
APO13.02
BAI06.01
BAI06.02
BAI06.03
BAI06.04
DSS01.01
DSS01.02
DSS01.03
DSS03.05
DSS05.01
DSS05.03
DSS05.07
APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.04
APO09.03
APO09.05
CC5.6
CC7.1
CC6.2
CC4.1
CC2.2
CC2.3
CC2.2
CC2.3
CC5.5
C1.4
C1.5
CC7.1 CM-3
CM-4
CP-10
RA-5
SA-7
SI-1
SI-2
SI-5
PCI-DSS v2.0

2.2 PCI-DSS v2.0

6.1 PCI-DSS v2.0

6.2 PCI-DSS v2.0

6.3.2 PCI-DSS v2.0

6.4.5 PCI-DSS v2.0

6.5.X
PCI-DSS v2.0

6.6 PCI-DSS v2.0

11.2 PCI-DSS v2.0

11.2.1 PCI-DSS v2.0

11.2.2 PCI-DSS v2.0

11.2.3 Threat and Vulnerbility
Management
Mobile Code
TVM03Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

S3.4.0
S3.10.0
(S3.4.0) Procedures exist to protect against
infection by computer viruses, malicious code, and
unauthorized software.
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system security policies to enable
authorized access and to prevent unauthorized
access.

G.20.12, I.2.5 SA-15 Domain 10 6.03. (g) Article 17 A.10.4.2 A.12.2.2
A.12.5.1
A.12.5.2
A.12.6.1
Commandment #4
Commandment #5
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment
#11
SC-18
CIP-007-3 -
R4 - R4.1 -
R4.2
SA-7
SC-5
SI-3
SI-5
SI-7
SI-8
PCI-DSS v2.0

5.1 PCI-DSS v2.0

5.1.1 PCI-DSS v2.0

5.2 Threat and Vulnerbility
Management
Vulnerability / Patch
Management
TVM02Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g. network vulnerability assessment, penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing remediation of identified vulnerabilities shall be used. Changes shall be managed through a change management process for all vendor-supplied patches, configuration changes, or changes to the organization's internally developed software. Upon request, the provider informs customer (tenant) of policies and procedures and identified weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

I.4 G.15.2, I.3 32 (B)
33 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-20 COBIT 4.1 AI6.1
COBIT 4.1 AI3.3
COBIT 4.1 DS5.9
Domain 2 6.03.02. (a)

6.03.02. (b)

6.03.05. (c)

6.07.01. (o)
Article 17 NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-5
45 CFR 164.308
(a)(1)(i)(ii)(A)
45 CFR 164.308
(a)(1)(i)(ii)(B)
45 CFR 164.308
(a)(5)(i)(ii)(B)
CIP-004-3
R4 - 4.1 -

4.2 CIP-005-
3a - R1 -
R1.1
CIP-007-3 -
R3 - R3.1 -
R8.4

1.2.6 8.2.7

8.1*partial,
A.14.2.2,

8.1*partial,
A.14.2.3
A.12.6.1
A.12.2.1
AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-7
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
RA-2
SA-1
SA-6
SC-1
SC-13
SI-1
PCI DSS v2.0

2.4 PCI DSS v2.0

12.8.2 PCI DSS v2.0

12.8.3 PCI DSS v2.0

12.8.4 Appendix A

8.2.2 45 CFR 164.308
(a)(5)(ii)(B)
A.10.4.1 Commandment #4
Commandment #5
Threat and Vulnerbility
Management
Antivirus / Malicious
Software
TVM01Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

S3.5.0 (S3.5.0) Procedures exist to protect against
infection by computer viruses, malicious codes,
and unauthorized software.

G.7 17 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-21 COBIT 4.1 DS5.9 Domain 2 6.03. (f) Article 17 NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-8
A.15.1.2

8.1* partial,

8.1* partial,
A.15.2.1
A.13.1.2
A.12.2.1
CC2.2
CC2.3
C1.4
C1.5
CC5.8
Commandment #1
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
Chapter II
Article 14.

CA-3
MP-5
PS-7
SA-6
SA-7
SA-9
PCI DSS v2.0

2.4 PCI DSS v2.0

12.8.2 Supply Chain
Management,
Transparency and
Accountability
Supply Chain Metrics
STA07Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream).

Reviews shall performed at least annually and identity nonconformance to established agreements. The reviews should result in actions to address service-level conflicts or inconsistencies resulting from disparate supplier relationships.

Supply Chain
Management,
Transparency and
Accountability
Third Party Audits
STA09Third-party service providers shall demonstrate compliance with information security and confidentiality, access control, service definitions, and delivery level agreements included in third-party contracts. Third-party reports, records, and services shall undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements.

S3.1.0
x3.1.0
(S3.1.0) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operations that
would impair system [availability, processing
integrity, confidentiality] commitments and (2)
assess the risks associated with the identified
threats.

L.1, L.2, L.4,
L.7, L.9
76 (B)
77 (B)
78 (B)
83 (B)
84 (B)
85 (B)
CO-05 COBIT 4.1 ME

2.6, DS 2.1, DS

2.4 Domain 2,
4 6.10. (a)

6.10. (b)

6.10. (c)

6.10. (d)

6.10. (e)

6.10. (f)

6.10. (g)

6.10. (h)

6.10. (i)
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1

1.2.2 1.2.4

1.2.6 1.2.11

3.2.4 5.2.1
45 CFR
164.308(b)(1)
(New)
45 CFR 164.308
(b)(4)
A.6.2.3
A.10.2.1
A.10.2.2
A.10.6.2
Commandment #1
Commandment #2
Commandment #3
Chapter II
Article 14, 21
Chapter III
Article 25
Chapter V
Article 36
A.6.2.3
A.10.6.2
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Metrics
SEF-05
Commandment #6
Commandment #7
Commandment #8
SC-20
SC-21
SC-22
SC-23
SC-24
ITOS > Service
Delivery > Service
Level
Management
Supply Chain
Management,
Transparency and
Accountability
Third Party Agreements
STA05Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutuallyagreed upon provisions and/or terms:
• Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business relationships, physical geographical location of hosted services, and any known regulatory compliance considerations)
• Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship, and references to detailed supporting and relevant business processes and technical measures implemented to enable effectively governance, risk management, assurance and legal, statutory and regulatory compliance obligations by all impacted business relationships
• Notification and/or pre-authorization of any changes controlled by the provider with customer (tenant) impacts
• Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business relationships impacted (i.e., up- and down-stream impacted supply chain)
• Assessment and independent verification of compliance with agreement provisions and/or terms (e.g., industry-acceptable certification, attestation audit report, or equivalent forms of assurance) without posing an unacceptable business risk of exposure to the organization being assessed
• Expiration of the business relationship and treatment of customer (tenant) data impacted
• Customer (tenant) service-to-service application (API) and data interoperability and portability requirements for application development and information exchange, usage, and integrity persistence
S2.2.0
A3.6.0
C3.6.0
(S2.2.0) The availability, confidentiality of data,
processing integrity, system security and related
security obligations of users and the entity’s
availability and related security commitments to
users are communicated to authorized users.
(A3.6.0) Procedures exist to restrict physical access
to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
(C3.6.0) The entity has procedures to obtain
assurance or representation that the
confidentiality policies of third parties to whom
information is transferred and upon which the
entity relies are in conformity with the entity’s
defined system confidentiality and related security
policies and that the third party is in compliance
with its policies.

C.2 C.2.4, C.2.6,
G.4.1, G.16.3
74 (B)
75 (C+,
A+)
45 (B)
75 (C+,
A+)
79 (B)
4 (C+, A+)
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.3
LG-02 COBIT 4.1 DS5.11 Domain 3 6.02. (e)

6.10. (h)

6.10. (i)
Article 17 (3) NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 MP-5
NIST SP 800-53 R3 MP-5 (2)
NIST SP 800-53 R3 MP-5 (4)
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
312.3, 312.8 and 1.2.5
312.10
A.6.2.3
A10.2.1
A.10.8.2
A.11.4.6
A.11.6.1
A.12.3.1
A.12.5.4
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Supply Chain
Management,
Transparency and
Accountability
Network /
Infrastructure Services
STA03Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems
components, shall be designed, developed, and deployed in accordance with mutually agreed-upon service and capacity-level expectations, as well as IT governance and service management policies and procedures.

C2.2.0 (C2.2.0) The system security, availability, system integrity, and confidentiality and related security
obligations of users and the entity’s system
security, availability, system integrity, and
confidentiality and related security commitments
to users are communicated to authorized users.

C.2 C.2.6, G.9.9 45 (B)
74 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-31 COBIT 4.1 DS5.10 Domain 2 6.02. (c)

6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

6.03.07. (d)
Article 17 NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 CP-6
NIST SP 800-53 R3 CP-6 (1)
NIST SP 800-53 R3 CP-6 (3)
NIST SP 800-53 R3 CP-7
NIST SP 800-53 R3 CP-7 (1)
NIST SP 800-53 R3 CP-7 (2)
NIST SP 800-53 R3 CP-7 (3)
NIST SP 800-53 R3 CP-7 (5)
NIST SP 800-53 R3 CP-8
NIST SP 800-53 R3 CP-8 (1)
NIST SP 800-53 R3 CP-8 (2)
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30

8.2.2 8.2.5
APO01.03
APO03.01
APO03.02
APO09.03
BAI02.01
BAI02.04
BAI07.05
Domain 2 6.07.01. (a)

6.07.01. (i)
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8

1.2.7 1.2.10
45 CFR 164.308
(a)(1)(ii)(D)
A.13.2.2 CIP-008-3 -
R1.1
IR-4
IR-5
IR-8
PCI DSS v2.0

12.9.6 Supply Chain
Management,
Transparency and
Accountability
Data Quality and
Integrity
STA01Providers shall inspect, account for, and work with their cloud supplychain partners to correct data quality errors and associated risks.

Providers shall design and implement controls to mitigate and contain data security risks through proper separation of duties, rolebased access, and least-privilege access for all personnel within their supply chain.

DSS04.07
APO10
APO11
DSS05.04
DSS06.03
DSS06.06
IS-25 PA11 BSGP
© Copyright 2014 Cloud Security Alliance - All rights reserved. You may download, store, display on your computer, view, print, and link to the Cloud Security Alliance “Consensus Assessments Initiative Questionnaire CAIQ Version

3.0.1” at http://www.cloudsecurityalliance.org subject to the following: (a) the Consensus Assessments Initiative Questionnaire v3.0.1 may be used solely for your personal, informational, non-commercial use; (b) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be modified or altered in any way; (c) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be redistributed; and (d) the trademark, copyright or other notices may not be removed. You may quote portions of the Consensus Assessments Initiative Questionnaire v3.0.1 as permitted by the Fair Use provisions of the United States Copyright Act, provided that you attribute the portions to the Cloud Security Alliance Cloud Consensus Assessments Initiative Questionnaire 3.0.1 (2014). If you are interested in obtaining a license to this material for other usages not addresses in the copyright notice, please contact [email protected].

Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

J.1.2 47 (B) COBIT 4.1 DS 4.9
Domain 2
51 (B) Domain 3 6.02. (c)

6.02. (d)

6.07.01. (k)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.15.1.2
A.13.1.2
A.15.1.2,

8.1* partial,
A.13.2.2,
A.9.4.1
A.10.1.1
Domain 2
A.16.1.6
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 89
#2..
- 133 -
CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE (CAIQ) V3.0.1 GUIDING DOCUMENT PRINCIPLES INTENT OF THIS TAB: To assist reviewers/users of document to understand both the intent and structure of CAIQ GUIDING PRINCIPLES:
 Questionnaire is organized using CSA 16 governing & operating domains divided into “control areas” within CSA’s Controls Matrix structure  Questions are to assist both cloud providers in general principles of cloud security and clients in vetting cloud providers on the security of their offering and company security profile
 CAIQ is not intended to duplicate or replace existing industry security assessments but to contain questions unique or critical to the cloud computing model in each control area
 Each question should be able to be answered yes or no  If a question can’t be answered yes or no then it was separated into two or more questions to allow yes or no answers.  Questions are intended to foster further detailed questions to provider by client specific to client’s cloud security needs. This was done to limit number of questions to make the assessment feasible and since each client may have unique follow-on questions or may not be concerned with all follow-on questions
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 90
#2..
- 134 -
CLOUD CONTROLS MATRIX VERSION 3.0.1
Scope
Applicability
Phys Network Compute Storage App Data SaaS PaaS IaaS Service Provider
Tenant /
Consumer
AICPA
2009 TSC Map
AICPA
Trust Service Criteria (SOC 2SM Report)
AICPA
2014 TSC
BITS Shared Assessments
AUP v5.0
BITS Shared Assessments
SIG v6.0 BSI Germany Canada PIPEDA CCM V1.X COBIT 4.1 COBIT 5.0 COPPA CSA Guidance V3.0 ENISA IAF 95/46/EC - European Union Data Protection Directive FedRAMP Security Controls
(Final Release, Jan 2012)
--LOW IMPACT LEVEL--
FedRAMP Security Controls
(Final Release, Jan 2012)
--MODERATE IMPACT LEVEL--
FERPA GAPP (Aug 2009) HIPAA / HITECH Act ISO/IEC 27001-2005 ISO/IEC 27001-2013 ITAR Jericho Forum Domain > Container > Capability Public Priv ate
Application & Interface
Security
Application Security
AIS-01 Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web
applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.

X X X X X X X X S3.10.0
S3.10.0
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined processing integrity and related security policies.

CC7.1 I.4 G.16.3, I.3 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-04 AI2.4 APO09.03 APO13.01
BAI03.01
BAI03.02
BAI03.03
BAI03.05
MEA03.01
MEA03.02
312.8 and
312.10
Application Services > Development
Process > Software Quality
Assurance
shared x Domain 10 6.03.01. (c) Article: 27 (3) NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-4
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-10
NIST SP 800-53 R3 SC-11
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SC-17
NIST SP 800-53 R3 SC-18

1.2.6 45 CFR 164.312(e)(2)(i) A.11.5.6
A.11.6.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.5.2
A.12.5.4
A.12.5.5
A.12.6.1
A.15.2.1
A9.4.2
A9.4.1,

8.1*Partial, A14.2.3,

8.1*partial, A.14.2.7
A12.6.1,
A18.2.2
Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment #11
Application & Interface
Security
Customer Access
Requirements
AIS-02 Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be
addressed.

X X X X X X X X X X X X S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 C.2.1, C.2.3, C.2.4, C.2.6.1, H.1 10 (B)
11 (A+)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3 SA-01 APO09.01 APO09.02
APO09.03
APO13.01
BAI02
DSS05
312.3,
312.8 and
312.10
BOSS > Legal Services > Contracts shared x Domain 10 Article 17 (1), (2) NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6

1.2.2 1.2.6

6.2.1 6.2.2
A.6.2.1
A.6.2.2
A.11.1.1
A9.1.1. Commandment #6
Commandment #7
Commandment #8
Application & Interface
Security
Data Integrity
AIS-03 Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.

X X X X X X X X X X I3.2.0
I3.3.0
I3.4.0
I3.5.0
(I3.2.0) The procedures related to completeness, accuracy, timeliness, and authorization of inputs are consistent with the documented system processing integrity policies.
(I3.3.0) The procedures related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies.
(I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policies.
(I3.5.0) There are procedures to enable tracing of information inputs from their source to their final disposition and vice versa.

PI1.2
PI1.3
PI1.5
I.4 G.16.3, I.3 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-05 DSS06.02 DSS06.04
312.8 and
312.10
Application Services >
Programming Interfaces > Input
Validation
shared x Domain 10 NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-9
NIST SP 800-53 R3 SI-10
NIST SP 800-53 R3 SI-11

1.2.6 45 CFR 164.312 (c)(1)
45 CFR 164.312 (c)(2)
45 CFR 164.312(e)(2)(i)
A.10.9.2
A.10.9.3
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.6.1
A.15.2.1
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
Commandment #1
Commandment #9
Commandment #11
Application & Interface
Security
Data Security / Integrity
AIS-04 Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity and availability) across multiple system interfaces,
jurisdictions and business functions to prevent improper disclosure, alteration, or destruction.

X X X X X X X X X X S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 B.1 G.8.2.0.2, G.8.2.0.3, G.12.1,
G.12.4, G.12.9, G.12.10, G.16.2,
G.19.2.1, G.19.3.2, G.9.4, G.17.2,
G.17.3, G.17.4, G.20.1
6 (B)
26 (A+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-03 DS5.11 APO09.01 APO09.02
APO09.03
APO13.01
DSS05.02
DSS06.06
MEA03.01
MEA03.02
312.8 and
312.10
BOSS > Data Governance > Rules
for Information Leakage Prevention
shared x Domain 10 6.02. (b)

1.1.0 1.2.2

1.2.6 4.2.3

5.2.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4

8.2.1 8.2.2

8.2.3 8.2.5

9.2.1 A.10.8.1
A.10.8.2
A.11.1.1
A.11.6.1
A.11.4.6
A.12.3.1
A.12.5.4
A.15.1.4
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
All
Audit Assurance &
Compliance
Audit Planning
AAC-01 Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.

X X X X X X X X X X X S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.
(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies.

Finance CommitteeApril 29, 2024

Finance Committee
April 29, 2024