Agenda packet — Modesto City Council, June 4, 2024 (part 5 of 11)

8.1 PCI DSS v2.0

8.2,
PCI DSS v2.0

8.3 PCI DSS v2.0

8.4 PCI DSS v2.0

8.5 PCI DSS v2.0

10.1,
PCI DSS v2.0

12.2,
PCI DSS v2.0

12.3.8 SRM > Privilege
Management
Infrastructure >
Identity
Management -
Identity
Provisioning
shared x 9.2

15.1 15.2
PA9
PA6
PA24
PA22

8.2.1 8.2.7
45 CFR 164.308
(a)(3)(ii)(B)
45 CFR 164.308
(a)(4)(ii)(C)
A.11.2.4 Commandment #6
Commandment #7
Commandment #8
Commandment
#10
CIP-004-3
R2.2.2
CIP-007-3 -
R5 - R.1.3
AC-2
AU-6
PM-10
PS-6
PS-7
Identity & Access
Management
User Access Revocation
IAM11Timely de-provisioning (revocation or modification) of user access to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components, shall be implemented as per established policies and procedures and based on user's change in status (e.g., termination of employment or other business relationship, job change or transfer). Upon request, provider shall inform customer (tenant) of these changes, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to,
the following matters:
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).

H.2 E.6.2, E.6.3 Schedule 1
(Section 5), 4.7 -
Safeguards
IS-09 COBIT 4.1 DS 5.4 Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

6.04.02. (b)
Article 17 NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 SC-30

8.2.1 45 CFR
164.308(a)(3)(ii)
(C)

ISO/IEC
27001:2005
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.2
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
User Access
Authorization
IAM09Provisioning user access (e.g., employees, contractors, customers (tenants), business partners and/or supplier relationships) to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components shall be authorized by the organization's management prior to access being granted and appropriately restricted as per established policies and procedures. Upon request, provider shall inform customer (tenant) of this user access, especially if customer (tenant) data is used as part of the service and/or customer (tenant) has some shared responsibility over implementation of control.

Identity & Access
Management
User Access Reviews
IAM10User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access violations, remediation must follow established user access policies and procedures.

H.2.6, H.2.7,
H.2.9,
41 (B) Schedule 1
(Section 5), 4.7 -
Safeguards
IS-10 COBIT 4.1 DS5.3
COBIT 4.1 DS5.4
45 CFR 164.308
(a)(3)(i)
45 CFR 164.308
(a)(3)(ii)(A)
45 CFR 164.308
(a)(4)(i)
45 CFR 164.308
(a)(4)(ii)(B)
45 CFR 164.308
(a)(4)(ii)(C)
45 CFR 164.312
(a)(1)
A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1
Identity & Access
Management
User Access Restriction
/ Authorization
IAM08Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary.

IS-08
IS-12
COBIT 4.1 DS5.4 Domain 12
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
NIST SP800-53 R3 AC-3
NIST SP800-53 R3 AC-5
NIST SP800-53 R3 AC-6
NIST SP800-53 R3 IA-2
NIST SP800-53 R3 IA-4
NIST SP800-53 R3 IA-5
NIST SP800-53 R3 IA-8
NIST SP800-53 R3 MA-5
NIST SP800-53 R3 PS-6
NIST SP800-53 R3 SA-7
NIST SP800-53 R3 SI-9
PCI DSS v2.0

7.1 PCI DSS v2.0

7.1.1 PCI DSS v2.0

7.1.2 PCI DSS v2.0

7.1.3 PCI DSS v2.0

7.2.1 PCI DSS v2.0

7.2.2 PCI DSS v2.0

8.5.1 PCI DSS v2.0

12.5.4 "FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the
data.(49) Managerial
measures include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of
passwords; and the
storage of data on secure
servers or computers . -
http://www.ftc.gov/repo
rts/privacy3/fairinfo.sht
m"
Domain 2 Article 17
S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to,
the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).

H.2.4, H.2.5, 35 (B)
40 (B)
41 (B)
42 (B)
44 (C+)
Schedule 1
(Section 5)
Safeguards, Subs.

4.7.2 and 4.7.3
IS-08 DS5.4 Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

6.03.06. (b)

6.04.01. (a)

6.04.01. (b)

6.04.01. (d)

6.04.01. (e)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)
APO01.03 Article 17
APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
SRM > Privilege
Management
Infrastructure >
Identity
Management -
Identity
Provisioning
shared x
SRM > Privilege
Management
Infrastructure >
Authorization
Services -
Entitlement
Review
shared x NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
S3.2.0
S4.3.0
(S3.2.0) Procedures exist to restrict logical access
to the defined system including, but not limited to,
the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations,
superuser functionality, master passwords,
powerful utilities, and security devices (for
example, firewalls).
(S4.3.0) Environmental, regulatory, and
technological changes are monitored, and their
effect on system availability, confidentiality,
processing integrity and security is assessed on a
timely basis; policies are updated for that
assessment.

Clause 4.3.3
A.12.4.3
A.15.1.3
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Commandment #6
Commandment #7
Commandment #9
Commandment
#10
CM-5
CM-6
PCI-DSS v2.0

6.4.1 PCI-DSS v2.0

6.4.2 Identity & Access
Management
Third Party Access
IAM07The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access.

Compensating controls derived from the risk analysis shall be implemented prior to provisioning access.

S3.1
x3.1.0
(S3.1) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operation that
would impair system [availability, processing
integrity, confidenitality] commitments and (2)
assess the risks associated with the identified
threats.

B.1
H.2
B.1.1, B.1.2,
D.1.1, E.1,
F.1.1, H.1.1,
K.1.1, E.6.2,
E.6.3
Schedule 1
(Section 5), 4.7 -
Safeguards
RI-05 COBIT 4.1 DS 2.3 Domain 2,
4 6.02. (a)

6.02. (b)

6.03. (a)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

7.1.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4
A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4
CA-3
MA-4
RA-3
PCI DSS v2.0

12.8.1 PCI DSS v2.0

12.8.2 PCI DSS v2.0

12.8.3 PCI DSS v2.0

12.8.4 Identity & Access
Management
Source Code Access
Restriction
IAM06Access to the organization's own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures.

S3.13.0 (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are
made to the system.

I.2.7.2, I.2.9,
I.2.10, I.2.15
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-33 Domain 2 Article 17 NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)

1.2.6 6.2.1
S3.4 (S3.4) Procedures exist to protect against
unauthorized access to system resources.

G.2
G.4
G.15
G.16
G.17
G.18
I.3
G.9.17, G.9.7,
G.10, G.9.11,
G.14.1, G.15.1,
G.9.2, G.9.3,
G.9.13
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
SA-08 Domain 10 6.03.03. (a)

6.03.03. (d)

6.03.04. (d)

6.04.07. (a)

6.07.01. ©
Article 17 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20
(1)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32

8.2.5 6.04.03. (b)

6.04.08. (a)

6.04.08. (b)

6.06. (a)

6.06. (b)

6.06. (c)

6.06. (d)

6.06. (e)

6.06. (f)
APO01.08 provider Domain 3
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
SRM >
Infrastructure
Protection
Services >
Network
provider x
Information
Technology
Operation
Services > Service
Delivery > Service
Level
Management -
External SLA's
A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2
(1)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5
(1)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7

7.1 7.1.1

7.1.2 7.1.3

7.2.1 7.2.2

8.5.1 12.5.4
AC-3
AC-5
AC-6
IA-2
IA-4
IA-5
IA-8
MA-5
PS-6
SA-7
SI-9
CIP-003-3 -
R5.1.1 -
R5.3
CIP-004-3
R2.3
CIP-007-3
R5.1 -
R5.1.2
A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1
45 CFR 164.308
(a)(3)(i)
45 CFR 164.308
(a)(3)(ii)(A)
45 CFR 164.308
(a)(4)(i)
45 CFR 164.308
(a)(4)(ii)(B)
45 CFR 164.308
(a)(4)(ii)(C)
45 CFR 164.312
(a)(1)
NIST SP 800-53 R3 AC-3 8.2.2
NIST SP 800-53 R3 AC-3 (3)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SC-30
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment
#10
Commandment
#11
A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4
A.12.1.4
A.14.2.9
A.9.1.1

8.1,partial,
A.14.2.2

8.1,partial,
A.14.2.3

8.1,partial,
A.14.2.4
A.13.1.3
A.9.4.1
A.18.1.4
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),
CIP-004-3
R2.2.4

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 2.2.2

2.2.3 Clause

5.2(c)

5.3(a),

5.3(b),

7.5.3(b)

7.5.3(d)

8.1,

8.3 9.2(g)
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.5
Annex
A.9.2,
A.9.2.1,
A.9.2.2,
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6,
A.9.3.1,
A.9.4.1,
A.9.4.2,
A.9.4.3,
A.9.4.5
A.9.2.1, A.9.2.2
A.9.2.3
A.9.1.2
A.9.4.1
A.9.2.5
Annex A
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.3
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.4
A.9.2.5
A.9.4.2
A.9.1.2
Deleted
A.9.4.4
A.12.4.1
A.12.4.1
A.12.4.2,
A.12.4.3
A.12.4.3
A.12.4.1
A.9.2.3
A.9.4.4
A.9.4.1
A.16.1.2
A.16.1.7
A.18.2.3
A.18.1.3
Annex
A.12.1.2
A.12.4,
A.12.4.1,
A.12.4.2,
A.12.4.3,
A.12.6.1,
A.12.6.2,
A.16.1.1,
A.16.1.2,
A.16.1.3,
A.16.1.4,
A.16.1.5,
A.16.1.6,
A.12.1.3
SRM > Privilege
Management
Infrastructure >
Privileged Usage
Management ->
Hypervisor
Governance and
Compliance
PA35 GP
Domain 1,
13 APO03.01
APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06
APO03.01
APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
APO03.01
APO03.02
APO03.04
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and 312.10
312.8 and 312.10
SRM >
Infrastructure
Protection
Services >
Network
provider x
SRM >
Infrastructure
Protection
Services >
Network -
Firewall
provider x
SRM >
Cryptographic
Services > Data-intransit Encryption
provider
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),
A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4
-
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 284
#15..
- 615 -
IPY-03.2 Do you provide policies and procedures (i.e. service level agreements) governing the migration of application data to and from your service?
IPY-04.1 Can data import, data export and service management be conducted over secure (e.g., non-clear text and authenticated), industry accepted standardized network protocols?
IPY-04.2 Do you provide consumers (tenants) with documentation detailing the relevant interoperability and portability network protocol standards that are involved?
IPY-05.1 Do you use an industry-recognized virtualization platform and standard virtualization formats (e,g., OVF) to help ensure interoperability?
IPY-05.2 Do you have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks available for customer review?
Mobile Security
Anti-Malware
MOS01MOS-01 Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training.

Do you provide anti-malware training specific to mobile devices as part of your information security awareness training?
- APO01.03
APO13.01
APO07.03
APO07.06
APO09.03
SRM >
Governance Risk
& Compliance >
Technical
Awareness and
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1) Mobile Security
Application Stores
MOS02MOS-02 A documented list of approved application stores has been communicated as acceptable for mobile devices accessing or storing provider managed data.

Do you document and make available lists of approved application stores for mobile devices accessing or storing company data and/or company systems?
- APO01.04
APO01.08
APO04.02
APO13.01
APO13.02
APO13.03
SRM > Policies
and Standards >
Technical
Securitry
Standards
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

4.1.1 Mobile Security
Approved Applications
MOS03MOS-03 The company shall have a documented policy prohibiting the installation of non-approved applications or approved applications not obtained through a pre-identified application store.

Do you have a policy enforcement capability (e.g., XACML) to ensure that only approved applications and those from approved application stores be loaded onto a mobile device?
- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
ITOS > Service
Support >
Configuration
Management -
Software
Management
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Mobile Security
Approved Software for
BYOD
MOS04MOS-04 The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage.

Does your BYOD policy and training clearly state which applications and applications stores are approved for use on BYOD devices? - APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM > Policies
and Standards >
Technical
Securitry
Standards
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Mobile Security 6.1.2(b)
Awareness and
Training
MOS05MOS-05 The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices. The provider shall post and communicate the policy and requirements through the company's security awareness and training program.

Do you have a documented mobile device policy in your employee training that clearly defines mobile devices and the accepted usage and requirements for mobile devices?
- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM > Policies
and Standards >
Technical
Securitry
Standards
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

4.3 Mobile Security
Cloud Based Services
MOS06MOS-06 All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.

Do you have a documented list of pre-approved cloud based services that are allowed to be used for use and storage of company business data via a mobile device?
- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM >
Governance Risk
& Compliance >
Vendor
Management
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Mobile Security
Compatibility
MOS07MOS-07 The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues.

Do you have a documented application validation process for testing device, operating system and application compatibility issues? - APO01.03
APO01.08
APO13.01
APO13.02
BAI03.07
BAI03.08
ITOS > Service
Support >
Configuration
Management -
Software
Management
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Device Eligibility
MOS08MOS-08 The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage.

Do you have a BYOD policy that defines the device(s) and eligibility requirements allowed for BYOD usage?
- APO01.03
APO01.08
APO13.01
APO13.02
BAI02.01
SRM > Policies
and Standards >
Information
Security Policies
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security
Device Inventory
MOS09MOS-09 An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices, (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD), will be included for each device in the inventory.

Do you maintain an inventory of all mobile devices storing and accessing company data which includes device status (os system and patch levels, lost or decommissioned, device assignee)? - BAI06.01
BAI06.02
BAI06.04
BAI10.01
BAI10.02
BAI10.03
SRM >
Infrastructure
Protection
Services > End
Point - Inventory
Control
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),
Mobile Security 6.1.2(c)(2)
Device Management
MOS10MOS-10 A centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data.

Do you have a centralized mobile device management solution deployed to all mobile devices that are permitted to store, transmit, or process company data?
- APO03.01
APO03.02
APO04.02
APO13.01
APO13.02
BAI02.01
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
Devices-Mobile
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Encryption
MOS11MOS-11 The mobile device policy shall require the use of encryption either for the entire device or for data identified as sensitive on all mobile devices and shall be enforced through technology controls.

Does your mobile device policy require the use of encryption for either the entire device or for data identified as sensitive enforceable through technology controls for all mobile devices?
- APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS06.06
SRM > Data
Protection >
Cryptographic
Services - Data-AtRest Encryption
providerX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
PA32 BSGP 4.1
MOS12.1Does your mobile device policy prohibit the circumvention of built-in security controls on mobile devices (e.g., jailbreaking or rooting)? MOS12.2Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls?
MOS13.1Does your BYOD policy clearly define the expectation of privacy, requirements for litigation, e-discovery and legal holds? MOS13.2Do you have detective and preventative controls on the device or via a centralized device management system which prohibit the circumvention of built-in security controls?
Mobile Security
Lockout Screen
MOS14MOS-14 BYOD and/or company owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls.

Do you require and enforce via technical controls an automatic lockout screen for BYOD and company owned devices?
- DSS05.03
DSS05.05
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
sharedX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security
Operating Systems
MOS15MOS-15 Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes.

Do you manage all changes to mobile device operating systems, patch levels and applications via your company's change management processes?
- APO01.03
APO13.01
APO13.02
BAI06
ITOS > Service
Support -Change
Management >
Planned Changes
sharedX None
(Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
MOS- 6.1.2(a)(2),

16.1 Do you have password policies for enterprise issued mobile devices and/or BYOD mobile devices?
MOS16.2Are your password policies enforced through technical controls (i.e.

MDM)?
MOS16.3Do your password policies prohibit the changing of authentication requirements (i.e. password/PIN length) via a mobile device? MOS17.1Do you have a policy that requires BYOD users to perform backups of specified corporate data?
MOS17.2Do you have a policy that requires BYOD users to prohibit the usage of unapproved application stores?
MOS17.3Do you have a policy that requires BYOD users to use anti-malware software (where supported)?
MOS18.1Does your IT provide remote wipe or corporate data wipe for all company-accepted BYOD devices?
MOS18.2Does your IT provide remote wipe or corporate data wipe for all company-assigned mobile devices?
MOS19.1Do your mobile devices have the latest available security-related patches installed upon general release by the device manufacturer or carrier?
MOS19.2Do your mobile devices allow for remote validation to download the latest security patches by company IT personnel?
MOS20.1Does your BYOD policy clarify the systems and servers allowed for use or access on the BYOD-enabled device?
MOS20.2Does your BYOD policy specify the user roles that are allowed access via a BYOD-enabled device?
Security Incident
Management, EDiscovery & Cloud
Forensics
Contact / Authority
Maintenance
SEF-01 SEF-01.1 Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impactedscope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement.

Do you maintain liaisons and points of contact with local authorities in accordance with contracts and appropriate regulations? CC3.3 APO01.01
APO01.02
APO01.03
APO01.08
MEA03.01
MEA03.02
MEA03.03
312.4 BOSS >
Compliance >
Contact/Authority
Maintenance
sharedx A.6.1.6
A.6.1.7
A.6.1.3
A.6.1.4
Chapter VI,
Article 44.

Chapter II,
Article 16, part I

3.2 12.5.3

12.10.1 SEF-02.1 Do you have a documented security incident response plan? SEF-02.2 Do you integrate customized tenant requirements into your security incident response plans?
SEF-02.3 Do you publish a roles and responsibilities document specifying what you vs. your tenants are responsible for during security incidents? SEF-02.4 Have you tested your security incident response plans in the last year?
SEF-03.1 Does your security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting? SEF-03.2 Does your logging and monitoring framework allow isolation of an incident to specific tenants?
SEF-04.1 Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?
SEF-04.2 Does your incident response capability include the use of legally admissible forensic data collection and analysis techniques? SEF-04.3 Are you capable of supporting litigation holds (freeze of data from a specific point in time) for a specific tenant without freezing other tenant data?
SEF-04.4 Do you enforce and attest to tenant data separation when producing data in response to legal subpoenas?
SEF-05.1 Do you monitor and quantify the types, volumes and impacts on all information security incidents?

4.1 12.1

12.10.1 PA8
PA11
BSGP
PA8 BSGP
SGP

4.1 4.2

4.6 7.1

7.2 7.3

7.2 7.3
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE

99.31(a)(1)(i)
34 CFR 99.32(a)
BOSS >
Operational Risk
Management >
Key Risk
Indicators
sharedx
Infrastructure
Services > Virtual
Infrastructure >
Server
Virtualization
providerXX
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
Devices-Mobile
Device
Management
sharedX
SRM >
Infrastructure
Protection
Services-
>Network > Link
Layer Network
Security
sharedX
SRM > Policies
and Standards >
Technical Security
Standards
sharedX
ITOS > Service
Support >
Security Incident
Management
sharedx
shared
sharedX
SRM > Data
Protection >
Cryptographic
Services - Data-InTransit Encryption
providerx
312.8 and 312.10
312.3, 312.8 and
312.10
312.8 and 312.10
312.8 and 312.10
APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
APO01.03
APO13.01
APO13.02
DSS05.03
APO01.03
APO13.01
APO13.02
CC5.5
CC6.2
CC2.3
CC2.5
C1.4
C1.5
CC2.5
CC6.2
CC6.2
CC4.1
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Metrics
SEF-05 Domain 2 6.07.01. (a)

6.07.01. (i)
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8

1.2.7 1.2.10
IR-2
IR-6
IR-7
SI-4
SI-5
45 CFR 164.308
(a)(1)(ii)(D)
A.13.2.2 CIP-008-3 -
R1.1
IR-4
IR-5
IR-8
PCI DSS v2.0

12.9.6 APO01.03
APO07.06
APO07.03
APO13.01
APO13.02
DSS02.01
APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
DSS04.07
PA11 BSGP
PA11 BSGP
PCI-DSS v2.0

12.5.2 PCI-DSS v2.0

12.5.3 Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Legal Preparation
SEF-04 Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation.

S2.4.0
C3.15.0
(S2.4.0) The process for informing the entity about
system availability issues, confidentiality issues,
processing integrity issues, security issues and
breaches of the system security and for submitting
complaints is communicated to authorized users.
(C3.15.0) Procedures exist to provide that issues of
noncompliance with defined confidentiality and
related security policies are promptly addressed
and that corrective measures are taken on a
timely basis.

J.1
E.1
J.1.1, J.1.2,
E.4
IS-24 COBIT 4.1 DS5.6 Domain 2 6.04.07. (b)

6.07.01. (f)

6.07.01. (h)
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 AU-7
NIST SP 800-53 R3 AU-7 (1)
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2)
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 MP-5
NIST SP 800-53 R3 MP-5 (2)
NIST SP 800-53 R3 MP-5 (4)

1.2.7 45 CFR 164.308
(a)(6)(ii)
Clause 4.3.3
Clause 5.2.2
A.8.2.2
A.8.2.3
A.13.2.3
A.15.1.3
BOSS > Legal
Services >
Incident
Response Legal
Preparation
sharedx CIP-004-3
R3.3
AU-6
AU-7
AU-9
AU-11
IR-5
IR-7
IR-8
BOSS > Human
Resources
Security >
Employee
Awareness
sharedx
Commandment #2
Commandment #6
Commandment #8
Chapter II, Article 20 CIP-007-3 -
R6.1
CIP-008-3 -
R1
IR-1
IR-2
IR-3
IR-4
IR-5
IR-7
IR-8
PCI-DSS v2.0

12.9 PCI-DSS v2.0

12.9.1 PCI-DSS v2.0

12.9.2 PCI-DSS v2.0

12.9.3 PCI-DSS v2.0

12.9.4 PCI-DSS v2.0

12.9.5 PCI-DSS v2.0

12.9.6 Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Reporting
SEF-03 Workforce personnel and external business relationships shall be informed of their responsibility and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations.

A2.3.0
C2.3.0
I2.3.0
S2.3.0
S2.4
(A2.3.0, C2.3.0, I2.3.0, S2.3.0) Responsibility and
accountability for the entity’s system availability,
confidentiality of data, processing integrity and
related security policies and changes and updates
to those policies are communicated to entity
personnel responsible for implementing them.
(S2.4) The process for informing the entity about
breaches of the system security and for submitting
J.1
E.1
J.1.1, E.4 5 (B)
46 (B)
48 (A+)
49 (B)
50 (B)
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.3
IS-23 COBIT 4.1 DS5.6 Domain 2 6.07.01. (a) Article 17 NIST SP 800-53 R3 IR-2 NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-6 (1)
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)

1.2.7 1.2.10

7.1.2 7.2.2

7.2.4 10.2.4
45 CFR 164.312
(a)(6)(ii)
16 CFR 318.3 (a)
(New)
16 CFR 318.5 (a)
(New)
45 CFR 160.410
(a)(1) (New)
Clause 4.3.3
Clause 5.2.2
A.6.1.3
A.8.2.1
A.8.2.2
A.13.1.1
A.13.1.2
A.13.2.1
ITAR 22
CFR §
127.12
Commandment #2
Commandment #6
Commandment #8
Chapter II, Article 20 CIP-003-3 -
R4.1
CIP-004-3
R3.3
IS3.7.0
S3.9.0
(IS3.7.0) Procedures exist to identify, report, and
act upon system security breaches and other
incidents.
(S3.9.0) Procedures exist to provide that issues of
noncompliance with system availability,
confidentiality of data, processing integrity and
related security policies are promptly addressed
and that corrective measures are taken on a
timely basis.

J.1 J.1.1, J.1.2 1.2.4

1.2.7 7.1.2

7.2.2 7.2.4

10.2.1 10.2.4
45 CFR 164.308
(a)(1)(i)
45 CFR 164.308
(a)(6)(i)
Clause 4.3.3
A.13.1.1
A.13.2.1
ITAR 22
CFR §
127.12
Mobile Security
Passwords
MOS16Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/PIN lengths and authentication requirements.

Mobile Security
Policy
MOS17The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported).

Mobile Security
Remote Wipe
MOS18All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's corporate IT.

Mobile Security
Security Patches
MOS19Mobile devices connecting to corporate networks or storing and accessing company information shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these updates remotely.

Mobile Security
Users
MOS20The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device.

Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Management
SEF-02 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures.

APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.03
APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06
APO01.03
APO13.01
APO13.02
APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
Interoperability &
Portability
Policy & Legal
IPY-03 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage and integrity persistence.

Interoperability &
Portability
Standardized Network
Protocols
IPY-04 The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.

Interoperability &
Portability
Virtualization
IPY-05 The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks, available for customer review.

Mobile Security
Jailbreaking and
Rooting
MOS12The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g. jailbreaking or rooting) and isenforced through detective and preventative controls on the device or through a centralized device management system (e.g. mobile device management).

Mobile Security
Legal
MOS13The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds.

The BYOD policy shall clearly state the expectations over the loss of non-company data in the case a wipe of the device is required.

IS-25 - Domain 6
46 (B) Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.4; 4.8
Openness, Subs.

4.8.2 IS-22 COBIT 4.1 DS5.6 Domain 2 6.04.07. (b)

6.07.01. (a)

6.07.01. (d)

6.07.01. (e)

6.07.01. (f)

6.07.01. (g)

6.07.01. (h)
Article 17 NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-3
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 IR-8
Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

S3.9.0
C4.1.0
(S3.9.0) Procedures exist to provide that issues of
noncompliance with security policies are promptly
addressed and that corrective measures are taken
on a timely basis.
(C4.1.0) The entity’s system security, availability,
system integrity, and confidentiality is periodically
reviewed and compared with the defined system
security, availability, system integrity, and
confidentiality policies.

J.1.2 47 (B) COBIT 4.1 DS 4.9 - None
(Mobile
Guidance)
- Domain 6
None
(Mobile
Guidance)
BOSS > Data
Governance >
Secure Disposal
of Data
- None
(Mobile
Guidance)
APO01.03
APO13.01
APO13.02
DSS05.03
- None
(Mobile
Guidance)
APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06
PA34
SRM > Policies
and Standards >
Technical Security
Standards
sharedX
None
(Mobile
Guidance)
None
(Mobile
Guidance)
- None
(Mobile
Guidance)
Presentation
Services >
Presentation
Platform > EndPoints-Mobile
Devices-Mobile
Device
Management
providerX
SRM > Policies
and Standards >
Information
Security Services

6.04.03. (b)

6.04.08. (a)

6.04.08. (b)

6.06. (a)

6.06. (b)

6.06. (c)

6.06. (d)

6.06. (e)

6.06. (f)
APO01.08 provider Domain 3
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
Information
Technology
Operation
Services > Service
Delivery > Service
Level
Management -
External SLA's
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
-
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.14.2.3
A.12.6.1
A.18.1.1
A.18.2.2
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)
Clause

5.3 (a),

5.3 (b),

7.5.3(b),

5.2 (c),

7.5.3(d),

8.1,

8.3,

9.2(g),
Annex
A.16.1.1
A.16.1.2
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),

7.3(c)

7.5.3(b),

7.5.3(d),

8.1,

8.3,

9.2(g)
Annex
A.7.2.2,
A.7.2.3,
A.16.1.7,
A.16.1.6
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 285
#15..
- 616 -
SEF-05.2 Will you share statistical information for security incident data with your tenants upon request?
STA-01.1 Do you inspect and account for data quality errors and associated risks, and work with your cloud supply-chain partners to correct them?
STA-01.2 Do you design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privileged access for all personnel within your supply chain?
Supply Chain
Management,
Transparency and
Accountability
Incident Reporting
STA02STA-02.1 The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals).

Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals)?
APO09.03
APO09.04
APO10.04
APO10.05
DSS02.07
ITOS > Service
Support ->
Incident
Management >
Cross Cloud
Incident
Response
prov ider Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
STA-03.1 Do you collect capacity and use data for all relevant components of 6.1.2(b) your cloud service offering?
STA-03.2 Do you provide tenants with capacity planning and use reports? Supply Chain
Management,
Transparency and
Accountability
Provider Internal
Assessments
STA04STA-04.1 The provider shall perform annual internal assessments of conformance and effectiveness of its policies, procedures, and supporting measures and metrics.

Do you perform annual internal assessments of conformance and effectiveness of your policies, procedures, and supporting measures and metrics?
MEA01
MEA02
SRM >
Governance Risk
& Compliance >
Vendor
Management
provider x Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

12.1.1 STA-05.1 Do you select and monitor outsourced providers in compliance with laws in the country where the data is processed, stored and transmitted?
STA-05.2 Do you select and monitor outsourced providers in compliance with laws in the country where the data originates?
STA-05.3 Does legal counsel review all third-party agreements? STA-05.4 Do third-party agreements include provision for the security and protection of information and assets?
STA-05.5 Do you provide the client with a list and copies of all subprocessing agreements and keep this updated?
Supply Chain
Management,
Transparency and
Accountability
Supply Chain
Governance Reviews
STA06STA-06.1 Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain.

Do you review the risk management and governanced processes of partners to account for risks inherited from other members of that partner's supply chain?
APO10.04
APO10.05
MEA01
SRM >
Governance Risk
& Compliance >
Vendor
Management
provider x Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

12.8.4 STA-07.1 Are policies and procedures established, and supporting business processes and technical measures implemented, for maintaining complete, accurate and relevant agreements (e.g., SLAs) between providers and customers (tenants)?
STA-07.2 Do you have the ability to measure and address non-conformance of provisions and/or terms across the entire supply chain
(upstream/downstream)?
STA-07.3 Can you manage service-level conflicts or inconsistencies resulting from disparate supplier relationships?
STA-07.4 Do you review all agreements, policies and processes at least annually?
Supply Chain
Management,
Transparency and
Accountability
Third Party Assessment
STA08STA-08.1 Providers shall assure reasonable information security across their information supply chain by performing an annual review. The review shall include all partners/third party providers upon which their information supply chain depends on.

Do you assure reasonable information security across your information supply chain by performing an annual review? STA-8.2 Does your annual review include all partners/third-party providers upon which your information supply chain depends?
STA-09.1 Do you permit tenants to perform independent vulnerability assessments?
STA-09.2 Do you have external third party services conduct vulnerability scans and periodic penetration tests on your applications and networks? TVM01.1Do you have anti-malware programs that support or connect to your cloud service offerings installed on all of your systems? TVM01.2Do you ensure that security threat detection systems using signatures, lists or behavioral patterns are updated across all infrastructure components within industry accepted time frames? TVM02.1Do you conduct network-layer vulnerability scans regularly as prescribed by industry best practices?
TVM02.2Do you conduct application-layer vulnerability scans regularly as prescribed by industry best practices?
TVM02.3Do you conduct local operating system-layer vulnerability scans regularly as prescribed by industry best practices?
TVM02.4Will you make the results of vulnerability scans available to tenants at their request?
TVM02.5Do you have a capability to rapidly patch vulnerabilities across all of your computing devices, applications and systems?
TVM02.6Will you provide your risk-based systems patching time frames to your tenants upon request?
TVM03.1Is mobile code authorized before its installation and use, and the code configuration checked, to ensure that the authorized mobile code operates according to a clearly defined security policy? TVM03.2Is all unauthorized mobile code prevented from executing?

2.4 12.8.2

12.8.3 12.8.4
Appendix A

1.4, 5.0

2.2 6.1

6.2 6.3.2

6.4.5 6.5

6.6 11.2

11.2.1 11.2.2

11.2.3 PA2
PA8
BSGP
PA3
PA8
PA16
BSGP
BSGP
SGP
PA1 BSGP

7.2 7.3

17.1 5.2

2.2 5.4

14.1 17.6

12.4 14.1
3 3.1

3.2 3.3

3.4 3.5
BOSS >
Compliance >
Third-Party Audits
shared x
SRM >
Infrastructure
Protection
Services > AntiVirus
shared x
SRM > Threat and
Vulnerability
Management >
Vulnerability
Management
shared x
SRM >
Infrastructure
Protection
Services > End
Point - White
Listing
shared x
BOSS >
Operational Risk
Management >
Key Risk
Indicators
shared x
SRM >
Governance Risk
& Compliance >
Vendor
Management
prov ider X
provider x
BOSS > Legal
Services >
Contracts
shared x
ITOS > Service
Delivery > Service
Level
Management -
Vendor
Management
provider x
SRM >
Governance Risk
& Compliance >
Vendor
Management
provider x
312.8 and 312.10
312.8 and 312.10
312.2(a) and
312.3 (Prohibition
on Disclosure)
312.8 and 312.10
312.8 and 312.10
312.8 and 312.10
APO01.03
APO09.03
APO09.04
APO09.05
APO10.01
APO10.03
APO10.04
APO09.03
MEA01
MEA02
APO01.08
APO10.05
MEA02.01
APO01.03
APO13.01
APO13.02
DSS05.01
APO01.03
APO13.01
APO13.02
BAI06.01
BAI06.02
BAI06.03
BAI06.04
DSS01.01
DSS01.02
DSS01.03
DSS03.05
DSS05.01
DSS05.03
DSS05.07
APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.04
APO09.03
APO09.05
CC5.6
CC7.1
CC6.2
CC4.1
CC2.2
CC2.3
CC2.2
CC2.3
CC5.5
C1.4
C1.5
CC7.1 CM-3
CM-4
CP-10
RA-5
SA-7
SI-1
SI-2
SI-5
PCI-DSS v2.0

2.2 PCI-DSS v2.0

6.1 PCI-DSS v2.0

6.2 PCI-DSS v2.0

6.3.2 PCI-DSS v2.0

6.4.5 PCI-DSS v2.0

6.5.X
PCI-DSS v2.0

6.6 PCI-DSS v2.0

11.2 PCI-DSS v2.0

11.2.1 PCI-DSS v2.0

11.2.2 PCI-DSS v2.0

11.2.3 Threat and Vulnerbility
Management
Mobile Code
TVM03Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

S3.4.0
S3.10.0
(S3.4.0) Procedures exist to protect against
infection by computer viruses, malicious code, and
unauthorized software.
(S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system security policies to enable
authorized access and to prevent unauthorized
access.

G.20.12, I.2.5 SA-15 Domain 10 6.03. (g) Article 17 A.10.4.2 A.12.2.2
A.12.5.1
A.12.5.2
A.12.6.1
Commandment #4
Commandment #5
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment
#11
SC-18
CIP-007-3 -
R4 - R4.1 -
R4.2
SA-7
SC-5
SI-3
SI-5
SI-7
SI-8
PCI-DSS v2.0

5.1 PCI-DSS v2.0

5.1.1 PCI-DSS v2.0

5.2 Threat and Vulnerbility
Management
Vulnerability / Patch
Management
TVM02Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g. network vulnerability assessment, penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing remediation of identified vulnerabilities shall be used. Changes shall be managed through a change management process for all vendor-supplied patches, configuration changes, or changes to the organization's internally developed software. Upon request, the provider informs customer (tenant) of policies and procedures and identified weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

S3.10.0 (S3.10.0) Design, acquisition, implementation,
configuration, modification, and management of
infrastructure and software are consistent with
defined system security policies to enable
authorized access and to prevent unauthorized
access.

I.4 G.15.2, I.3 32 (B)
33 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-20 COBIT 4.1 AI6.1
COBIT 4.1 AI3.3
COBIT 4.1 DS5.9
Domain 2 6.03.02. (a)

6.03.02. (b)

6.03.05. (c)

6.07.01. (o)
Article 17 NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-5
45 CFR 164.308
(a)(1)(i)(ii)(A)
45 CFR 164.308
(a)(1)(i)(ii)(B)
45 CFR 164.308
(a)(5)(i)(ii)(B)
CIP-004-3
R4 - 4.1 -

4.2 CIP-005-
3a - R1 -
R1.1
CIP-007-3 -
R3 - R3.1 -
R8.4

1.2.6 8.2.7

8.1*partial,
A.14.2.2,

8.1*partial,
A.14.2.3
A.12.6.1
A.12.2.1
AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-7
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
RA-2
SA-1
SA-6
SC-1
SC-13
SI-1
PCI DSS v2.0

2.4 PCI DSS v2.0

12.8.2 PCI DSS v2.0

12.8.3 PCI DSS v2.0

12.8.4 Appendix A

8.2.2 45 CFR 164.308
(a)(5)(ii)(B)
A.10.4.1 Commandment #4
Commandment #5
Threat and Vulnerbility
Management
Antivirus / Malicious
Software
TVM01Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

S3.5.0 (S3.5.0) Procedures exist to protect against
infection by computer viruses, malicious codes,
and unauthorized software.

G.7 17 (B) Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-21 COBIT 4.1 DS5.9 Domain 2 6.03. (f) Article 17 NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-8
A.15.1.2

8.1* partial,

8.1* partial,
A.15.2.1
A.13.1.2
A.12.2.1
CC2.2
CC2.3
C1.4
C1.5
CC5.8
Commandment #1
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
Chapter II
Article 14.

CA-3
MP-5
PS-7
SA-6
SA-7
SA-9
PCI DSS v2.0

2.4 PCI DSS v2.0

12.8.2 Supply Chain
Management,
Transparency and
Accountability
Supply Chain Metrics
STA07Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream).

Supply Chain
Management,
Transparency and
Accountability
Third Party Audits
STA09Third-party service providers shall demonstrate compliance with information security and confidentiality, access control, service definitions, and delivery level agreements included in third-party contracts. Third-party reports, records, and services shall undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements.

S3.1.0
x3.1.0
(S3.1.0) Procedures exist to (1) identify potential
threats of disruption to systems operation that
would impair system security commitments and
(2) assess the risks associated with the identified
threats.
(x3.1.0) Procedures exist to (1) identify potential
threats of disruptions to systems operations that
would impair system [availability, processing
integrity, confidentiality] commitments and (2)
assess the risks associated with the identified
threats.

L.1, L.2, L.4,
L.7, L.9
76 (B)
77 (B)
78 (B)
83 (B)
84 (B)
85 (B)
CO-05 COBIT 4.1 ME

2.6, DS 2.1, DS

2.4 Domain 2,
4 6.10. (a)

6.10. (b)

6.10. (c)

6.10. (d)

6.10. (e)

6.10. (f)

6.10. (g)

6.10. (h)

6.10. (i)
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1

1.2.2 1.2.4

1.2.6 1.2.11

3.2.4 5.2.1
45 CFR
164.308(b)(1)
(New)
45 CFR 164.308
(b)(4)
A.6.2.3
A.10.2.1
A.10.2.2
A.10.6.2
Commandment #1
Commandment #2
Commandment #3
Chapter II
Article 14, 21
Chapter III
Article 25
Chapter V
Article 36
A.6.2.3
A.10.6.2
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Metrics
SEF-05
Commandment #6
Commandment #7
Commandment #8
SC-20
SC-21
SC-22
SC-23
SC-24
ITOS > Service
Delivery > Service
Level
Management
Supply Chain
Management,
Transparency and
Accountability
Third Party Agreements
STA05Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutuallyagreed upon provisions and/or terms:
• Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business relationships, physical geographical location of hosted services, and any known regulatory compliance considerations)
• Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship, and references to detailed supporting and relevant business processes and technical measures implemented to enable effectively governance, risk management, assurance and legal, statutory and regulatory compliance obligations by all impacted business relationships
• Notification and/or pre-authorization of any changes controlled by the provider with customer (tenant) impacts
• Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business relationships impacted (i.e., up- and down-stream impacted supply chain)
• Assessment and independent verification of compliance with agreement provisions and/or terms (e.g., industry-acceptable certification, attestation audit report, or equivalent forms of assurance) without posing an unacceptable business risk of exposure to the organization being assessed
• Expiration of the business relationship and treatment of customer (tenant) data impacted
• Customer (tenant) service-to-service application (API) and data interoperability and portability requirements for application development and information exchange, usage, and integrity persistence
S2.2.0
A3.6.0
C3.6.0
(S2.2.0) The availability, confidentiality of data,
processing integrity, system security and related
security obligations of users and the entity’s
availability and related security commitments to
users are communicated to authorized users.
(A3.6.0) Procedures exist to restrict physical access
to the defined system including, but not limited to,
facilities, backup media, and other system
components such as firewalls, routers, and
servers.
(C3.6.0) The entity has procedures to obtain
assurance or representation that the
confidentiality policies of third parties to whom
information is transferred and upon which the
entity relies are in conformity with the entity’s
defined system confidentiality and related security
policies and that the third party is in compliance
with its policies.

C.2 C.2.4, C.2.6,
G.4.1, G.16.3
74 (B)
75 (C+,
A+)
45 (B)
75 (C+,
A+)
79 (B)
4 (C+, A+)
Schedule 1
(Section 5) 4.1
Accountability,
Subs. 4.1.3
LG-02 COBIT 4.1 DS5.11 Domain 3 6.02. (e)

6.10. (h)

6.10. (i)
Article 17 (3) NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 MP-5
NIST SP 800-53 R3 MP-5 (2)
NIST SP 800-53 R3 MP-5 (4)
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
312.3, 312.8 and 1.2.5
312.10
A.6.2.3
A10.2.1
A.10.8.2
A.11.4.6
A.11.6.1
A.12.3.1
A.12.5.4
ITAR 22
CFR §
120.17
EAR 15
CFR
§736.2 (b)
Supply Chain
Management,
Transparency and
Accountability
Network /
Infrastructure Services
STA03Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems
components, shall be designed, developed, and deployed in accordance with mutually agreed-upon service and capacity-level expectations, as well as IT governance and service management policies and procedures.

C2.2.0 (C2.2.0) The system security, availability, system integrity, and confidentiality and related security
obligations of users and the entity’s system
security, availability, system integrity, and
confidentiality and related security commitments
to users are communicated to authorized users.

C.2 C.2.6, G.9.9 45 (B)
74 (B)
Schedule 1
(Section 5), 4.7 -
Safeguards,
Subsec. 4.7.3
IS-31 COBIT 4.1 DS5.10 Domain 2 6.02. (c)

6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

6.03.07. (d)
Article 17 NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 CP-6
NIST SP 800-53 R3 CP-6 (1)
NIST SP 800-53 R3 CP-6 (3)
NIST SP 800-53 R3 CP-7
NIST SP 800-53 R3 CP-7 (1)
NIST SP 800-53 R3 CP-7 (2)
NIST SP 800-53 R3 CP-7 (3)
NIST SP 800-53 R3 CP-7 (5)
NIST SP 800-53 R3 CP-8
NIST SP 800-53 R3 CP-8 (1)
NIST SP 800-53 R3 CP-8 (2)
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30

8.2.2 8.2.5
APO01.03
APO03.01
APO03.02
APO09.03
BAI02.01
BAI02.04
BAI07.05
Domain 2 6.07.01. (a)

6.07.01. (i)
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8

1.2.7 1.2.10
45 CFR 164.308
(a)(1)(ii)(D)
A.13.2.2 CIP-008-3 -
R1.1
IR-4
IR-5
IR-8
PCI DSS v2.0

12.9.6 Supply Chain
Management,
Transparency and
Accountability
Data Quality and
Integrity
STA01Providers shall inspect, account for, and work with their cloud supplychain partners to correct data quality errors and associated risks.

Providers shall design and implement controls to mitigate and contain data security risks through proper separation of duties, rolebased access, and least-privilege access for all personnel within their supply chain.

DSS04.07
APO10
APO11
DSS05.04
DSS06.03
DSS06.06
IS-25 PA11 BSGP
© Copyright 2014 Cloud Security Alliance - All rights reserved. You may download, store, display on your computer, view, print, and link to the Cloud Security Alliance “Consensus Assessments Initiative Questionnaire CAIQ Version

3.0.1” at http://www.cloudsecurityalliance.org subject to the following: (a) the Consensus Assessments Initiative Questionnaire v3.0.1 may be used solely for your personal, informational, non-commercial use; (b) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be modified or altered in any way; (c) the Consensus Assessments Initiative Questionnaire v3.0.1 may not be redistributed; and (d) the trademark, copyright or other notices may not be removed. You may quote portions of the Consensus Assessments Initiative Questionnaire v3.0.1 as permitted by the Fair Use provisions of the United States Copyright Act, provided that you attribute the portions to the Cloud Security Alliance Cloud Consensus Assessments Initiative Questionnaire 3.0.1 (2014). If you are interested in obtaining a license to this material for other usages not addresses in the copyright notice, please contact [email protected].

Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

J.1.2 47 (B) COBIT 4.1 DS 4.9
Domain 2
51 (B) Domain 3 6.02. (c)

6.02. (d)

6.07.01. (k)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a)

6.1.3(b)

8.1 8.3

9.3(a),

9.3(b)

9.3(b)(f)

9.3(c)

9.3(c)(1)

9.3(c)(2)

9.3(c)(3)

9.3(d)

9.3(e)

9.3(f)
A.15.1.2
A.13.1.2
A.15.1.2,

8.1* partial,
A.13.2.2,
A.9.4.1
A.10.1.1
Domain 2
A.16.1.6
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 286
#15..
- 617 -
CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE (CAIQ) V3.0.1 GUIDING DOCUMENT PRINCIPLES INTENT OF THIS TAB: To assist reviewers/users of document to understand both the intent and structure of CAIQ GUIDING PRINCIPLES:
 Questionnaire is organized using CSA 16 governing & operating domains divided into “control areas” within CSA’s Controls Matrix structure  Questions are to assist both cloud providers in general principles of cloud security and clients in vetting cloud providers on the security of their offering and company security profile
 CAIQ is not intended to duplicate or replace existing industry security assessments but to contain questions unique or critical to the cloud computing model in each control area
 Each question should be able to be answered yes or no  If a question can’t be answered yes or no then it was separated into two or more questions to allow yes or no answers.  Questions are intended to foster further detailed questions to provider by client specific to client’s cloud security needs. This was done to limit number of questions to make the assessment feasible and since each client may have unique follow-on questions or may not be concerned with all follow-on questions
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 287
#15..
- 618 -
CLOUD CONTROLS MATRIX VERSION 3.0.1
Scope
Applicability
Phys Network Compute Storage App Data SaaS PaaS IaaS Service Provider
Tenant /
Consumer
AICPA
2009 TSC Map
AICPA
Trust Service Criteria (SOC 2SM Report)
AICPA
2014 TSC
BITS Shared Assessments
AUP v5.0
BITS Shared Assessments
SIG v6.0 BSI Germany Canada PIPEDA CCM V1.X COBIT 4.1 COBIT 5.0 COPPA CSA Guidance V3.0 ENISA IAF 95/46/EC - European Union Data Protection Directive FedRAMP Security Controls
(Final Release, Jan 2012)
--LOW IMPACT LEVEL--
FedRAMP Security Controls
(Final Release, Jan 2012)
--MODERATE IMPACT LEVEL--
FERPA GAPP (Aug 2009) HIPAA / HITECH Act ISO/IEC 27001-2005 ISO/IEC 27001-2013 ITAR Jericho Forum Domain > Container > Capability Public Priv ate
Application & Interface
Security
Application Security
AIS-01 Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web
applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.

X X X X X X X X S3.10.0
S3.10.0
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined processing integrity and related security policies.

CC7.1 I.4 G.16.3, I.3 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-04 AI2.4 APO09.03 APO13.01
BAI03.01
BAI03.02
BAI03.03
BAI03.05
MEA03.01
MEA03.02
312.8 and
312.10
Application Services > Development
Process > Software Quality
Assurance
shared x Domain 10 6.03.01. (c) Article: 27 (3) NIST SP 800-53 R3 SC-5 NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-4
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SC-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-10
NIST SP 800-53 R3 SC-11
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-14
NIST SP 800-53 R3 SC-17
NIST SP 800-53 R3 SC-18

1.2.6 45 CFR 164.312(e)(2)(i) A.11.5.6
A.11.6.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.5.2
A.12.5.4
A.12.5.5
A.12.6.1
A.15.2.1
A9.4.2
A9.4.1,

8.1*Partial, A14.2.3,

8.1*partial, A.14.2.7
A12.6.1,
A18.2.2
Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment #11
Application & Interface
Security
Customer Access
Requirements
AIS-02 Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be
addressed.

X X X X X X X X X X X X S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 C.2.1, C.2.3, C.2.4, C.2.6.1, H.1 10 (B)
11 (A+)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3 SA-01 APO09.01 APO09.02
APO09.03
APO13.01
BAI02
DSS05
312.3,
312.8 and
312.10
BOSS > Legal Services > Contracts shared x Domain 10 Article 17 (1), (2) NIST SP 800-53 R3 CA-1 NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6

1.2.2 1.2.6

6.2.1 6.2.2
A.6.2.1
A.6.2.2
A.11.1.1
A9.1.1. Commandment #6
Commandment #7
Commandment #8
Application & Interface
Security
Data Integrity
AIS-03 Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.

X X X X X X X X X X I3.2.0
I3.3.0
I3.4.0
I3.5.0
(I3.2.0) The procedures related to completeness, accuracy, timeliness, and authorization of inputs are consistent with the documented system processing integrity policies.
(I3.3.0) The procedures related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies.
(I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policies.
(I3.5.0) There are procedures to enable tracing of information inputs from their source to their final disposition and vice versa.

PI1.2
PI1.3
PI1.5
I.4 G.16.3, I.3 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-05 DSS06.02 DSS06.04
312.8 and
312.10
Application Services >
Programming Interfaces > Input
Validation
shared x Domain 10 NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-9
NIST SP 800-53 R3 SI-10
NIST SP 800-53 R3 SI-11

1.2.6 45 CFR 164.312 (c)(1)
45 CFR 164.312 (c)(2)
45 CFR 164.312(e)(2)(i)
A.10.9.2
A.10.9.3
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.6.1
A.15.2.1
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
Commandment #1
Commandment #9
Commandment #11
Application & Interface
Security
Data Security / Integrity
AIS-04 Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity and availability) across multiple system interfaces,
jurisdictions and business functions to prevent improper disclosure, alteration, or destruction.

X X X X X X X X X X S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 B.1 G.8.2.0.2, G.8.2.0.3, G.12.1,
G.12.4, G.12.9, G.12.10, G.16.2,
G.19.2.1, G.19.3.2, G.9.4, G.17.2,
G.17.3, G.17.4, G.20.1
6 (B)
26 (A+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-03 DS5.11 APO09.01 APO09.02
APO09.03
APO13.01
DSS05.02
DSS06.06
MEA03.01
MEA03.02
312.8 and
312.10
BOSS > Data Governance > Rules
for Information Leakage Prevention
shared x Domain 10 6.02. (b)

6.04.03. (a)
Article 17 (1), (2),(3), (4) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-4
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-8

1.1.0 1.2.2

1.2.6 4.2.3

5.2.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4

8.2.1 8.2.2

8.2.3 8.2.5

9.2.1 A.10.8.1
A.10.8.2
A.11.1.1
A.11.6.1
A.11.4.6
A.12.3.1
A.12.5.4
A.15.1.4
A13.2.1,
A13.2.2,
A9.1.1,
A9.4.1,
A10.1.1
A18.1.4
All
Audit Assurance &
Compliance
Audit Planning
AAC-01 Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.

X X X X X X X X X X X S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.
(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies.

CC4.1 L.1, L.2, L.7, L.9, L.11 58 (B) CO-01 ME 2.1
ME 2.2
PO 9.5
PO 9.6
APO12.04
APO12.05
APO12.06
MEA02.01
MEA02.02
Title 16
Part 312
BOSS > Compliance > Audit
Planning
shared x Domain 2, 4 6.01. (d) NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 PL-6

10.2.5 45 CFR 164.312(b) Clause 4.2.3 e)
Clause 4.2.3b
Clause 5.1 g
Clause 6
A.15.3.1
Clauses

4.3(a),

4.3(b),

5.1(e),

5.1(f),

6.2(e),

9.1,

9.1(e),

9.2,
Commandment #1
Commandment #2
Commandment #3
Audit Assurance &
Compliance
Independent Audits
AAC-02 Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards,
procedures, and compliance obligations.

X X X X X X X X X X X X S4.1.0
S4.2.0
(S4.1.0) The entity’s system security is periodically reviewed and compared with the defined system security policies.
(S4.2.0) There is a process to identify and address potential impairments to the entity’s ongoing ability to achieve its objectives in accordance with its defined system security policies.

CC4.1 L.2, L.4, L.7, L.9, L.11 58 (B)
59 (B)
61 (C+, A+)
76 (B)
77 (B)
CO-02 DS5.5
ME2.5
ME 3.1
PO 9.6
APO12.04
APO12.05
DSS05.07
MEA02.06
MEA02.07
MEA02.08
MEA03.01
Title 16
Part 312
BOSS > Compliance > Independent
Audits
shared x Domian 2, 4 6.03. (e)

6.07.01. (m)

6.07.01. (n)
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)

1.2.5 1.2.7

4.2.1 8.2.7

10.2.3 10.2.5
45 CFR 164.308 (a)(8)
45 CFR 164.308(a)(1)(ii)(D)
Clause 4.2.3e
Clause 5.1 g
Clause 5.2.1 d)
Clause 6
A.6.1.8
Clauses

4.3(a),

4.3(b),

5.1(e),

5.1(f),

9.1,

9.2,

9.3(f),
A18.2.1
Commandment #1
Commandment #2
Commandment #3
Audit Assurance &
Compliance
Information System
Regulatory Mapping
AAC-03 Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are
reflected.

X X X X X X X X X X X X S3.1.0
x3.1.0
(S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operations that would impair system [availability, processing integrity, confidentiality] commitments and (2) assess the risks associated with the identified threats.

CC3.1 L.1, L.2, L.4, L.7, L.9 76 (B)
77 (B)
78 (B)
83 (B)
84 (B)
85 (B)
Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.1.3
CO-05 ME 3.1 APO12.01
APO12.02
APO12.03
MEA03.01
312.4 BOSS > Compliance > Information
System Regulatory Mapping
shared x Domain 2, 4 6.10. (a)

6.10. (b)

6.10. (c)

6.10. (d)

6.10. (e)

6.10. (f)

6.10. (g)

6.10. (h)

1.2.2 1.2.4

1.2.6 1.2.11

3.2.4 5.2.1
ISO/IEC 27001:2005
Clause 4.2.1 b) 2)
Clause 4.2.1 c) 1)
Clause 4.2.1 g)
Clause 4.2.3 d) 6)
Clause 4.3.3
Clause 5.2.1 a - f
Clause 7.3 c) 4)
A.7.2.1
A.15.1.1
A.15.1.3
A.15.1.4
A.15.1.6
Clauses

4.2(b),

4.4,

5.2(c),

5.3(ab),

6.1.2,

6.1.3,

6.1.3(b),

7.5.3(b),

7.5.3(d),

8.1,

8.3 9.2(g),

9.3,

9.3(b),

9.3(f),

10.2,
A.8.2.1,
A.18.1.1,
A.18.1.3,
A.18.1.4,
A.18.1.5
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Business Continuity
Planning
BCR-01 A consistent unified framework for business continuity planning and plan
development shall be established, documented and adopted to ensure all
business continuity plans are consistent in addressing
priorities for
testing, maintenance, and information security requirements.

Requirements for business continuity plans include the
following:
• Defined purpose and scope, aligned with relevant
dependencies
• Accessible to and understood by those who will use them • Owned by a named person(s) who is responsible for their review, update, and approval
• Defined lines of communication, roles, and responsibilities • Detailed recovery procedures, manual work-around, and reference information
• Method for plan invocation
X X X X X X X X X X X X A3.1.0
A3.3.0
A3.4.0
(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.

CC3.1
A1.2
A1.3
K.1.2.3. K.1.2.4, K.1.2.5, K.1.2.6,
K.1.2.7, K.1.2.11, K.1.2.13,
K.1.2.15
RS-03 DSS04.01
DSS04.02
DSS04.03
DSS04.05 BOSS > Operational Risk Management > Business Continuity provider x Domain 7, 8 6.07. (a)

6.07. (b)

6.07. (c)
Article 17 (1), (2) NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 CP-1
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-2 (1)
NIST SP800-53 R3 CP-2 (2)
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-4 (1)
NIST SP800-53 R3 CP-6
NIST SP800-53 R3 CP-6 (1)
NIST SP800-53 R3 CP-6 (3)
NIST SP800-53 R3 CP-7
NIST SP800-53 R3 CP-7 (1)
NIST SP800-53 R3 CP-7 (2)
NIST SP800-53 R3 CP-7 (3)
NIST SP800-53 R3 CP-7 (5)
NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-8 (1)
NIST SP800-53 R3 CP-8 (2)
NIST SP800-53 R3 CP-9
NIST SP800-53 R3 CP-9 (1)
NIST SP800-53 R3 CP-9 (3)
NIST SP800-53 R3 CP-10
NIST SP800-53 R3 CP-10 (2)
NIST SP800-53 R3 CP-10 (3)
NIST SP800-53 R3 PE-17
45 CFR 164.308 (a)(7)(i)
45 CFR 164.308 (a)(7)(ii)(B)
45 CFR 164.308 (a)(7)(ii)(C)
45 CFR 164.308 (a)(7)(ii)(E)
45 CFR 164.310 (a)(2)(i)
45 CFR 164.312 (a)(2)(ii)
Clause 5.1
A.6.1.2
A.14.1.3
A.14.1.4
Clause 5.1(h)
A.17.1.2
A.17.1.2
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Business Continuity
Testing
BCR-02 Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.

X X X X X X X X X X X X A3.3 (A3.3) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.

A1.2 K.1.3, K.1.4.3, K.1.4.6, K.1.4.7,
K.1.4.8, K.1.4.9, K.1.4.10,
K.1.4.11, K.1.4.12
52 (B)
55 (A+)
RS-04 DSS04.04 BOSS > Operational Risk Management > Business Continuity provider x Domain 7, 8 6.07.01. (b)

6.07.01. (j)

6.07.01. (l)
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-2
NIST SP800-53 R3 CP-2 (1)
NIST SP800-53 R3 CP-2 (2)
NIST SP800-53 R3 CP-3
NIST SP800-53 R3 CP-4
NIST SP800-53 R3 CP-4 (1)
45 CFR 164.308 (a)(7)(ii)(D) A.14.1.5 A17.3.1 Commandment #1 Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Datacenter Utilities /
Environmental
Conditions
BCR-03 Datacenter utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications,and internet connectivity) shall be
secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with
automated fail-over or other redundancies in the event of planned or unplanned disruptions.

X X X X X X A3.2.0
A3.4.0
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A3.4.0) Procedures exist to protect against unauthorized access to system resource.

A1.1
A1.2
A1.3
F.1 F.1.6, F.1.6.1, F.1.6.2, F.1.9.2,
F.2.10, F.2.11, F.2.12
9 (B)
10 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RS-08 DSS01.03 DSS01.04
DSS01.05
DSS04.03 312.8 and 312.10 Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.08. (a)

6.09. (c)

6.09. (f)

6.09. (g)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-4
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
A.9.2.2
A.9.2.3
A11.2.2,
A11.2.3
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #9
Commandment #11
Business Continuity
Management &
Operational Resilience
Documentation
BCR-04 Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made
available to authorized personnel to ensure the following:
• Configuring, installing, and operating the information system
• Effectively using the system’s security features
X X X X X X X X X X S3.11.0
A.2.1.0
(S3.11.0) Procedures exist to provide that personnel responsible for the design, development, implementation, and operation of systems affecting security have the qualifications and resources to fulfill their responsibilities.
(A.2.1.0) The entity has prepared an objective description of the system and its boundaries and communicated such description to authorized users.

CC1.3
CC1.4
CC2.1
G.1.1 56 (B)
57 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 OP-02 DS 9 DS 13.1
BAI08
BAI10
DSS01.01
312.8 and 312.10 SRM > Policies and Standards >
Job Aid Guidelines
shared x Domain 7, 8 Article 17 NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3)
NIST SP 800-53 R3 CP-10
NIST SP 800-53 R3 CP-10 (2)
NIST SP 800-53 R3 CP-10 (3)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)

1.2.6 Clause 4.3.3
A.10.7.4
Clause 9.2(g) Commandment #1
Commandment #2
Commandment #4
Commandment #5
Commandment #11
Business Continuity
Management &
Operational Resilience
Environmental Risks
BCR-05 Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have
countermeasures applied.

X X X X X X A3.1.0
A3.2.0
(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.

CC3.1
A1.1
A1.2
F.1 F.2.9, F.1.2.21, F.5.1, F.1.5.2,
F.2.1, F.2.7, F.2.8
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RS-05 DSS01.03 DSS01.04
DSS01.05 Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.07. (d)

6.08. (a)

6.09. (a)

6.09. (b)

6.09. (d)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-18

8.2.4 45 CFR 164.308 (a)(7)(i)
45 CFR 164.310(a)(2)(ii)
A.9.1.4
A.9.2.1
A11.1.4,
A11.2.1
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Equipment Location
BCR-06 To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability
environmental risks and supplemented by redundant
equipment located at a reasonable distance.

CC3.1
A1.1
A1.2
F.1 F.2.9, F.1.2.21, F.5.1, F.1.5.2,
F.2.1, F.2.7, F.2.8
53 (A+)
75 (C+, A+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RS-06 DSS01.04 DSS01.05 312.8 and
312.10
Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.07. (d)

6.08. (a)

6.09. (a)

6.09. (b)

6.09. (d)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-5
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 PE-15
NIST SP800-53 R3 PE-18
45 CFR 164.310 (c) A.9.2.1 A11.2.1 Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Equipment
Maintenance
BCR-07 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel.

X X X X X X X X X X X A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies.

A1.1
A1.2
CC4.1
F.2.19 1 (B) OP-04 A13.3 BAI03.10
BAI04.03
BAI04.04
DSS03.05
Infra Services > Equipment
Maintenance >
provider x Domain 7, 8 6.09. (h) Article 17 (1) NIST SP 800-53 R3 MA-2 NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 MA-3
NIST SP 800-53 R3 MA-3 (1)
NIST SP 800-53 R3 MA-3 (2)
NIST SP 800-53 R3 MA-3 (3)
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 MA-6

5.2.3 8.2.2

8.2.3 8.2.4

8.2.5 8.2.6

8.2.7 45 CFR 164.310 (a)(2)(iv) A.9.2.4 A11.2.4 Commandment #2 Commandment #5
Commandment #11
Business Continuity
Management &
Operational Resilience
Equipment Power
Failures
BCR-08 Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific Business Impact Assessment
X X X X X X X X A3.2.0 (A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.

A1.1
A1.2
F.1 F.1.6, F.1.6.1, F.1.6.2, F.1.9.2,
F.2.10, F.2.11, F.2.12
54 (A+) Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RS-07 DSS01.04 DSS01.05
DSS04.01
DSS04.02
DSS04.03 312.8 and 312.10 Infra Services > Facility Security > Environmental Risk Management provider x Domain 7, 8 6.08. (a)

6.09. (e)

6.09. (f)
Article 17 (1), (2) NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-12
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-14
NIST SP800-53 R3 CP-8
NIST SP800-53 R3 CP-8 (1)
NIST SP800-53 R3 CP-8 (2)
NIST SP800-53 R3 PE-1
NIST SP800-53 R3 PE-9
NIST SP800-53 R3 PE-10
NIST SP800-53 R3 PE-11
NIST SP800-53 R3 PE-12
NIST SP800-53 R3 PE-13
NIST SP800-53 R3 PE-13 (1)
NIST SP800-53 R3 PE-13 (2)
NIST SP800-53 R3 PE-13 (3)
NIST SP800-53 R3 PE-14
A.9.2.2
A.9.2.3
A 9.2.4
A.11.2.2,
A.11.2.3,
A.11.2.4
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Impact Analysis
BCR-09 There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following:
• Identify critical products and services
• Identify all dependencies, including processes, applications, business partners, and third party service providers
• Understand threats to critical products and services
• Determine impacts resulting from planned or unplanned disruptions and how these vary over time
• Establish the maximum tolerable period for disruption • Establish priorities for recovery
• Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption
• Estimate the resources required for resumption
X X X X X X X X X X X X A3.1.0
A3.3.0
A3.4.0
(A3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system availability commitments and (2) assess the risks associated with the identified threats.
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.

CC3.1
A1.2
A1.3
K.2 RS-02 BAI06.01
BAI10.01
BAI10.02
BAI10.03
DSS04.01
DSS04.02 ITOS > Service Delivery > Information Technology Resiliency - Resiliency Analysis provider x Domain 7, 8 6.02. (a)

6.03.03. (c)

6.07. (a)

6.07. (b)

6.07. (c)
Article 17 (1), (2) NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 RA-3
45 CFR 164.308 (a)(7)(ii)(E) ISO/IEC 27001:2005
A.14.1.2
A 14.1.4
A.17.1.1
A.17.1.2
Commandment #1
Commandment #2
Commandment #3
Business Continuity
Management &
Operational Resilience
Policy
BCR-10 Policies and procedures shall be established, and supporting business
processes and technical measures implemented, for
appropriate IT
governance and service management to ensure appropriate planning,
delivery and support of the organization's IT capabilities supporting
business functions, workforce, and/or customers based on industry
acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies
and procedures shall include defined roles and
responsibilities
supported by regular workforce training.

X X X X X X S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity, system security and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2 G.1.1 45 (B) OP-01 DS13.1 APO01
APO07.01
APO07.03
APO09.03
DSS01.01
SRM > Policies and Standards >
Operational Security Baselines
shared x Domain 7, 8 6.03. (c) NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12

8.2.1 Clause 5.1
A 8.1.1
A.8.2.1
A 8.2.2
A.10.1.1
Clause 5.1(h)
A.6.1.1
A.7.2.1
A.7.2.2
A.12.1.1
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
Business Continuity
Management &
Operational Resilience
Retention Policy
BCR-11 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance
obligations. Backup and recovery measures shall be
incorporated as part of business continuity planning and tested accordingly for effectiveness.

X X X X X X X X X X A3.3.0
A3.4.0
I3.20.0
I3.21.0
(A3.3.0) Procedures exist to provide for backup, offsite storage, restoration, and disaster recovery consistent with the entity’s defined system availability and related security policies.
(A3.4.0) Procedures exist to provide for the integrity of backup data and systems maintained to support the entity’s defined system availability and related security policies.
(I3.20.0) Procedures exist to provide for restoration and disaster recovery consistent with the entity’s defined processing integrity policies.
(I3.21.0) Procedures exist to provide for the completeness, accuracy, and timeliness of backup data and systems.

A1.2
A1.3
I3.21
D.2.2.9 36 (B) Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.5.2
DG-04 DS 4.1
DS 4.2
DS 4.5
DS 4.9
DS 11.6
BAI09.01
BAI09.02
BAI09.03
DSS04.01
DSS04.02
DSS04.03
DSS04.04
DSS04.07
MEA03.01
312.3 BOSS > Data Governance > Data
Retention Rules
shared x Domain 5 6.03. (h)

6.07.01. (c)
Article 6(1) e NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-2
NIST SP 800-53 R3 CP-2 (1)
NIST SP 800-53 R3 CP-2 (2)
NIST SP 800-53 R3 CP-6
NIST SP 800-53 R3 CP-6 (1)
NIST SP 800-53 R3 CP-6 (3)
NIST SP 800-53 R3 CP-7
NIST SP 800-53 R3 CP-7 (1)
NIST SP 800-53 R3 CP-7 (2)
NIST SP 800-53 R3 CP-7 (3)
NIST SP 800-53 R3 CP-7 (5)
NIST SP 800-53 R3 CP-8
NIST SP 800-53 R3 CP-8 (1)
NIST SP 800-53 R3 CP-8 (2)
NIST SP 800-53 R3 CP-9
NIST SP 800-53 R3 CP-9 (1)
NIST SP 800-53 R3 CP-9 (3)

5.1.0 5.1.1

5.2.2 8.2.6
45 CFR 164.308 (a)(7)(ii)(A)
45 CFR 164.310 (d)(2)(iv)
45 CFR 164.308(a)(7)(ii)(D)
45 CFR 164.316(b)(2)(i) (New)
Clause 4.3.3
A.10.5.1
A.10.7.3
Clauses

9.2(g)

7.5.3(b)

5.2 (c)

7.5.3(d)

5.3(a)

5.3(b)

8.1 8.3
A.12.3.1
A.8.2.3
EAR 15 §
762.6 Period
of Retention
EAR 15
CFR § 786.2
Recordkeepi
ng
Commandment #11
Change Control &
Configuration
Management
New Development /
Acquisition
CCC-01 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data,
physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or datacenter facilities have been pre-authorized by the
organization's business leadership or other accountable business role or function.

X X X X X X X X X X S3.12.0
S3.10.0
S3.13.0
(S3.12.0) Procedures exist to maintain system components, including configurations consistent with the defined system security policies.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies.
(S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.2
CC7.1
CC7.4
I.2 I.1.1, I.1.2, I.2. 7.2, I.2.8, I.2.9,
I.2.10, I.2.13, I.2.14, I.2.15, I.2.18,
I.2.22.6, L.5
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-01 A12 A16.1
APO01.02
APO01.06
BAI02.04
BAI06.01
ITOS > IT Operation > Architecture
Governance
shared x None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)

1.2.6 A.6.1.4
A.6.2.1
A.12.1.1
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.5
A.15.1.3
A.15.1.4
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* (partial) A.14.2.7
A.18.1.3
A.18.1.4
Commandment #1
Commandment #2
Commandment #3
Change Control &
Configuration
Management
Outsourced
Development
CCC-02 External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g. ITIL service management processes).

X X X X X X X X X X S3.10.0
S3.13
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies. (S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.1
CC7.4
C.2
I.1
I.2
I.4
C.2.4, G.4, G6, I.1, I.4.4, I.4.5,
I.2.7.2, I.2.8, I.2.9, I.2.15, I.2.18,
I.2.22.6, I.2.7.1, I.2.13, I.2.14,
I.2.17, I.2.20, I.2.22.2, I.2.22.4,
I.2.22.7, I.2.22.8, I.2.22.9,
I.2.22.10, I.2.22.11, I.2.22.12,
I.2.22.13, I.2.22.14, I.3, J.1.2.10,
L.7, L.9, L.10
27 (B) Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-04 APO07.06 APO09.03
APO09.04
APO10.01
APO10.04
APO10.05
APO11.01
APO11.02
APO11.04
APO11.05 ITOS > IT Operation > Architecture Governance shared x None NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)
NIST SP 800-53 R3 SA-12
A.6.1.8
A.6.2.1
A.6.2.3
A.10.1.4
A.10.2.1
A.10.2.2
A.10.2.3
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.5.5
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
A18.2.1
A.15.1.2
A.12.1.4

8.1* (partial)

8.1* (partial) A.15.2.1

8.1* (partial) A.15.2.2
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* (partial) A.14.2.2

8.1* (partial) A.14.2.3

8.1* (partial) A.14.2.4

8.1* (partial) A.14.2.7
A.12.6.1
A.16.13
A.18.2.2
A.18.2.3
Commandment #1
Commandment #2
Commandment #3
Change Control &
Configuration
Management
Quality Testing
CCC-03 Organization shall follow a defined quality change control and testing process (e.g. ITIL Service Management) with
established baselines, testing, and release standards that focus on system availability, confidentiality, and integrity of systems and services.

X X X X X X X X X A3.13.0
C3.16.0
I3.14.0
S3.10.0
S3.13
(A3.13.0, C3.16.0, I3.14.0, S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system availability, confidentiality of data, processing integrity, systems security and related security policies.
(S3.13) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.1
CC7.1
CC7.1
CC7.1
CC7.4
C.1.7, G.1, G.6, I.1, I.4.5, I.2.18,
I.22.1, I.22.3, I.22.6, I.2.23,
I.2.22.2, I.2.22.4, I.2.22.7. I.2.22.8,
I.2.22.9, I.2.22.10, I.2.22.11,
I.2.22.12, I.2.22.13,
I.2.22.14,I.2.20, I.2.17, I.2.7.1, I.3,
J.2.10, L.9
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-03 PO 8.1 APO11.01 APO11.02
APO11.04
APO11.05
BAI02.04
BAI03.06
BAI03.08
BAI07.03
BAI07.05
ITOS > Service Support > Release
Management
shared x None 6.03.01. (b)

6.03.01. (d)
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 SA-3
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SA-5
NIST SP 800-53 R3 SA-5 (1)
NIST SP 800-53 R3 SA-5 (3)
NIST SP 800-53 R3 SA-8
NIST SP 800-53 R3 SA-10
NIST SP 800-53 R3 SA-11
NIST SP 800-53 R3 SA-11 (1)

9.1.0 9.1.1

9.2.1 9.2.2
A.6.1.3
A.10.1.1
A.10.1.4
A.10.3.2
A.12.1.1
A.12.2.1
A.12.2.2
A.12.2.3
A.12.2.4
A.12.4.1
A.12.4.2
A.12.4.3
A.12.5.1
A.12.5.2
A.12.5.3
A.12.6.1
A.13.1.2
A.15.2.1
A.15.2.2
A.6.1.1
A.12.1.1
A.12.1.4
A.14.2.9
A.14.1.1
A.12.5.1
A.14.3.1
A.9.4.5

8.1* partial A.14.2.2

8.1* partial A.14.2.3

8.1* partial A.14.2.4
A.12.6.1
A.16.1.3
A.18.2.2
A.18.2.3
Commandment #1
Commandment #2
Commandment #3
Change Control &
Configuration
Management
Unauthorized Software
Installations
CCC-04 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on
organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

X X X X X X X X A3.6.0
S3.5.0
S3.13.0
(A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (S3.5.0) Procedures exist to protect against infection by computer viruses, malicious code, and unauthorized software.
(S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC5.5
CC5.8
CC7.4
G.1
I.2
G.2.13, G.20.2,G.20.4, G.20.5,
G.7, G.7.1, G.12.11, H.2.16,
I.2.22.1, I.2.22.3, I.2.22.6, I.2.23
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-05 APO13.01 BAI06.01
BAI10
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03 312.8 and 312.10 ITOS > Service Support > Configuration Management -> Software Mangement shared x None NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 CM-8
NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 SA-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)

3.2.4 8.2.2
A.10.1.3
A.10.4.1
A.11.5.4
A.11.6.1
A.12.4.1
A.12.5.3
A.6.1.2
A.12.2.1
A.9.4.4
A.9.4.1
A.12.5.1

8.1* (partial) A.14.2.4
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #11
Change Control &
Configuration
Management
Production Changes
CCC-05 Policies and procedures shall be established for managing the risks associated with applying changes to:
• business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations
• infrastructure network and systems components
Technical measures shall be implemented to provide
assurance that all changes directly correspond to a
registered change request, business-critical or customer (tenant) , and/or authorization by, the customer (tenant) as per agreement (SLA) prior to deployment.

X X X X X X X X X X X A3.16.0
S3.13.0
(A3.16.0, S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.4
CC7.4
I.2.17, I.2.20, I.2.22 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 RM-02 A16.1 A17.6
BAI06.01
BAI06.02
BAI06.03
BAI06.04
BAI07.01
BAI07.03
BAI07.04
BAI07.05
BAI07.06
ITOS > Service Support > Release
Management
shared x None 6.03. (a) NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-5
NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 CM-9
NIST SP 800-53 R3 PL-2
NIST SP 800-53 R3 PL-5
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-6
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)

1.2.6 45 CFR 164.308 (a)(5)(ii)(C)
45 CFR 164.312 (b)
A.10.1.4
A.12.5.1
A.12.5.2
A.12.1.4

8.1* (partial) A.14.2.2

8.1* (partial) A.14.2.3
Commandment #1
Commandment #2
Commandment #3
Commandment #11
Data Security &
Information Lifecycle
Management
Classification
DSI-01 Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization.

X X X X X X X X X X S3.8.0
C3.14.0
(S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary.
(C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.

CC3.1
CC3.1
D.1.3, D.2.2 DG-02 PO 2.3
DS 11.6
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
312.3 BOSS > Data Governance > Data
Classification
shared x Domain 5 6.04.03. (a) Article 4 (1),
Article 12, Article 17
NIST SP 800-53 R3 RA-2 NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 AC-4

1.2.3 1.2.6

4.1.2 8.2.1

8.2.5 8.2.6
A.7.2.1 A.8.2.1 Commandment #9
Data Security &
Information Lifecycle
Management
Data Inventory / Flows
DSI-02 Policies and procedures shall be established to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service's applications and infrastructure network and systems. In particular,
providers shall ensure that data that is subject to geographic residency requirements not be migrated beyond its defined bounds.
-- APO01.06
APO03.01
APO03.02
APO09.01
APO09.01
BAI06.03
BAI09.01
BAI10.01
BAI10.02
BAI10.03
BAI10.04
BAI10.05
BOSS > Data Governance >
Handling / Labeling / Security Policy
Domain 5 6.10. (a)

6.10. (b)

6.10. (c)

6.10. (d)

6.10. (e)
NIST SP 800-53 R3 SC-30 Clause

4.2 5.2,

7.5,

8.1 Data Security &
Information Lifecycle
Management
eCommerce
Transactions
DSI-03 Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data.

X X X X X X X S3.6
I13.3.a-e
I3.4.0
(S3.6) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. (I13.3.a-e) The procedues related to completeness, accuracy, timeliness, and authorization of system processing, including error correction and database management, are consistent with documented system processing integrity policies.
(I3.4.0) The procedures related to completeness, accuracy, timeliness, and authorization of outputs are consistent with the documented system processing integrity policiies.

CC5.7
PI1.5
G.4
G.11
G.16
G.18
I.3
I.4
G.19.1.1, G.19.1.2, G.19.1.3,
G.10.8, G.9.11, G.14, G.15.1
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-28 DS 5.10 5.11 APO01.06 APO03.02
APO08.01
APO13.01
APO13.02
DSS05
DSS06
312.8 and
312.10
SRM > Cryptographic Services >
Data in Transit Encryption
shared x Domain 2 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AC-22
NIST SP 800-53 R3 AU-10
NIST SP 800-53 R3 AU-10 (5)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)

3.2.4 4.2.3

7.1.2 7.2.1

7.2.2 8.2.1

8.2.5 45 CFR 164.312(e)(1)
45 CFR 164.312(e)(2)(i)
A.7.2.1
A.10.6.1
A.10.6.2
A.10.9.1
A.10.9.2
A.15.1.4
A.8.2.1
A.13.1.1
A.13.1.2
A.14.1.2
A.14.1.3
A.18.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment #10
Commandment #11
Data Security &
Information Lifecycle
Management
Handling / Labeling /
Security Policy
DSI-04 Policies and procedures shall be established for the labeling, handling, and security of data and objects which contain data.

Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.

X X X X X X X X X X S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 G.13 D.2.2 DG-03 PO 2.3
DS 11.6
APO01.06
APO03.02
APO08.01
APO09.03
APO13.01
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
312.2 BOSS > Data Governance >
Handling / Labeling / Security Policy
shared x Domain 5 6.03.05. (b) Article 22
Article 23
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-16
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-12

99.31.(a)(1)(ii) 1.1.2

5.1.0 7.1.2

8.1.0 8.2.5

8.2.6 A.7.2.2
A.10.7.1
A.10.7.3
A.10.8.1
A.8.2.2
A.8.3.1
A.8.2.3
A.13.2.1
Commandment #8
Commandment #9
Commandment #10
Data Security &
Information Lifecycle
Management
Non-Production Data
DSI-05 Production data shall not be replicated or used in nonproduction environments.X X X X X X X C3.5.0 S3.4.0
C3.21.0
(C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against unauthorized access to system resources.
(C3.21.0) Procedures exist to provide that confidential information is protected during the system development, testing, and change processes in accordance with defined system confidentiality and related security policies.

C1.3
CC5.6
C1.1
I.2.18 DG-06 APO01.06
BAI01.01
BAI03.07
BAI07.04 SRM > Policies and Standards > Technical Standard (Data Management Security Standard) shared x Domain 5 6.03. (d) NIST SP 800-53 R3 SA-11 NIST SP 800-53 R3 SA-11 (1)

1.2.6 45 CFR 164.308(a)(4)(ii)(B) A.7.1.3
A.10.1.4
A.12.4.2
A.12.5.1
A.8.1.3
A.12.1.4
A.14.3.1

8.1* (partial) A.14.2.2.

Commandment #9
Commandment #10
Commandment #11
Data Security &
Information Lifecycle
Management
Ownership /
Stewardship
DSI-06 All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.

X X X X X X X X X S2.2.0
S2.3.0
S3.8.0
(S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. (S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.
(S3.8.0) Procedures exist to classify data in accordance with classification policies and periodically monitor and update such classifications as necessary
CC2.3
CC3.1
C.2.5.1, C.2.5.2, D.1.3, L.7 Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.1.3
DG-01 DS5.1
PO 2.3
APO01.06
APO03.02
APO13.01
APO13.03
312.4 BOSS > Data Governance > Data
Ownership / Stewadship
shared x Domain 5 Article 4 NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 CA-2
NIST SP 800-53 R3 CA-2 (1)
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 SA-2

6.2.1 45 CFR 164.308 (a)(2) A.6.1.3
A.7.1.2
A.15.1.4
A.6.1.1
A.8.1.2
A.18.1.4
Commandment #6
Commandment #10
Data Security &
Information Lifecycle
Management
Secure Disposal
DSI-07 Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements.

X X X X X X X X X C3.5.0
S3.4.0
(C3.5.0) The system procedures provide that confidential information is disclosed to parties only in accordance with the entity’s defined confidentiality and related security policies.
(S3.4.0) Procedures exist to protect against unauthorized access to system resources.

C1.3
CC5.6
D.2.2.10, D.2.2.11, D.2.2.14, 37 (B) Schedule 1 (Section 5) 4.5 - Limiting Use, Disclosure and Retention, Subsec. 4.7.5 and 4.5.3
DG-05 DS 11.4 APO01.06
APO13.01
BAI09.03
DSS01.01
312.3 BOSS > Data Governance > Secure
Disposal of Data
shared x Domain 5 6.03. (h) Article 16
Article 17
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)
NIST SP 800-53 R3 PE-1

5.1.0 5.2.3
45 CFR 164.310 (d)(2)(i)
45 CFR 164.310 (d)(2)(ii)
A.9.2.6
A.10.7.2
A.11.2.7
A.8.3.2
Commandment #11
Datacenter Security
Asset Management
DCS-01 Assets must be classified in terms of business criticality, service-level expectations, and operational continuity
requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated
regularly, and assigned ownership by defined roles and
responsibilities.

X X X X X S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies.
c. Assessing risks on a periodic basis.

CC3.1
CC3.1
Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-08 APO01.06 APO03.02
APO08.01
APO09.03
BAI09.01
BAI09.02
BAI09.03
DSS04.07
DSS05.04
DSS05.05
DSS06.06 ITOS > Service Support > Configuration Management - Physical Inventory provider x Domain 8 Article 17 Annex A.8 Datacenter Security
Controlled Access
Points
DCS-02 Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.

X X X X X A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.5 F.2 F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.3, F.1.4.2, F1.4.6, F.1.4.7,
F.1.6, F.1.7,F.1.8, F.2.13, F.2.14,
F.2.15, F.2.16, F.2.17, F.2.18
7 (B) Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-03 DS 12.2 DS 12.3
APO13.01
DSS01.01
DSS01.05
DSS05.05
DSS06.03
DSS06.06
312.8 and 312.10 Infra Services > Facility Security >
Controlled Physical Access
provider x Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-8
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-8
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 A.9.1.1
A.9.1.2
A.11.1.1
A.11.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Datacenter Security
Equipment Identification
DCS-03 Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location.

X X X X X S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 D.1 D.1.1, D.1.3 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-13 DS5.7 APO13.01 DSS05.02
DSS05.03
312.3,
312.8 and
312.10
> > Domain 10 6.05. (a) Article 17 NIST SP 800-53 R3 IA-4 NIST SP 800-53 R3 IA-3 NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
A.11.4.3 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #8
Datacenter Security
Off-Site Authorization
DCS-04 Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.

X X X X X X X X S3.2.f
C3.9.0
(S3.2.f) f. Restriction of access to offline storage, backup data, systems, and media.
(C3.9.0) Procedures exist to restrict physical access to the defined system including, but not limited to: facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.1
CC5.5
F.2.18, F.2.19, Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.5 FS-06 EDM05.02 APO01.02
APO03.02
BAI02.03
BAI02.04
BAI03.09
BAI06.01 312.8 and
312.10
SRM > Facility Security > Asset Handlingprovider x Domain 8 6.08. (a)

6.09. (j)
Article 17 NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-17
45 CFR 164.310 (c )
45 CFR 164.310 (d)(1)
45 CFR 164.310 (d)(2)(i)
A.9.2.5
A.9.2.6
A.11.2.6
A.11.2.7
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #4
Commandment #5
Commandment #11
Datacenter Security
Off-Site Equipment
DCS-05 Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the
organization's premises. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full overwrite of the drive to ensure that the erased drive is released to inventory X X X X X X X X X X X X S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 D.1 D.1.1, D.2.1. D.2.2, Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.5 FS-07 APO09.03 APO10.04
APO10.05
APO13.01
DSS01.02 312.8 and
312.10
BOSS > Data Governance > Secure Disposal of Data provider x Domain 8 6.05. (a)

6.05. (b)

6.05. (c)
Article 17 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 NIST SP 800-53 R3 CM-8 (1)
NIST SP 800-53 R3 CM-8 (3)
NIST SP 800-53 R3 CM-8 (5)
NIST SP 800-53 R3 SC-30
45 CFR 164.310 (d)(2)(iii) A.7.1.1
A.7.1.2
A.8.1.1
A.8.1.2
Commandment #6
Commandment #7
Commandment #8
Datacenter Security
Policy
DCS-06 Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information.

X X X A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.5 H.6 F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.4.2, F1.4.6, F.1.4.7, F.1.7,
F.1.8, F.2.13, F.2.14, F.2.15,
F.2.16, F.2.17, F.2.18
7 (B) Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-01 APO13.01 DSS01.04
DSS01.05
DSS04.01
DSS04.03 SRM > Policies and Standards > Information Security Policies (Facility Security Policy) provider x Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 PE-5
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)

99.31.a.1.ii 8.2.1

8.2.2 8.2.3
45 CFR 164.310(a)(1)
45 CFR 164.310(a)(2)(ii)
45 CFR 164.310(b)
45 CFR 164.310 ( c) (New)
A.9.1.1
A.9.1.2
A.11.1.1
A.11.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Datacenter Security -
Secure Area
Authorization
DCS-07 Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.

X X X X X X X X X X A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.5 F.2 F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.3, F.1.4.2, F1.4.6, F.1.4.7,
F.1.6, F.1.7,F.1.8, F.2.13, F.2.14,
F.2.15, F.2.16, F.2.17, F.2.18
7 (B) Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-04 DS 12.3 APO13.01 APO13.02
DSS05.05
312.8 and 312.10 SRM > Policies and Standards >
Information Security Policy (Facility
Security Policy)
provider x Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-7
NIST SP 800-53 R3 PE-7 (1)
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 A.9.1.6 A.11.1.6 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Datacenter Security
Unauthorized Persons
Entry
DCS-08 Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.

X X X X X X X X A3.6.0 (A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.

CC5.5 G.21 F.2.18 Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-05 APO13.01 APO13.02
DSS05.05
DSS06.03 312.8 and
312.10
SRM > Policies and Standards > Information Security Policy (Facility Security Policy) provider x Domain 8 6.08. (a)

6.09. (j)
Article 17 NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 PE-16
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MA-2
NIST SP 800-53 R3 MA-2 (1)
NIST SP 800-53 R3 PE-16

99.31.a.1.ii 8.2.5

8.2.6 45 CFR 164.310 (d)(1) A.9.2.7
A.10.1.2
A.11.2.5

8.1* (partial) A.12.1.2
Commandment #6
Commandment #7
Datacenter Security
User Access
DCS-09 Physical access to information assets and functions by users and support personnel shall be restricted.

CC5.5 F.2 F.1.2.3, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.3, F.1.4.2, F1.4.6, F.1.4.7,
F.1.6, F.1.7,F.1.8, F.2.13, F.2.14,
F.2.15, F.2.16, F.2.17, F.2.18
7 (B)
10 (B)
Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 FS-02 DS 12.3 APO13.01 APO13.02
DSS05.04
DSS05.05
DSS06.03
312.8 and 312.10 Infra Services > Facility Security > Domain 8 6.08. (a)

6.09. (i)
Article 17 NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 PE-6
NIST SP 800-53 R3 PE-6 (1)
NIST SP 800-53 R3 PE-18

99.31.a.1.ii 8.2.3 A.9.1.1 A.11.1.1 ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #1
Commandment #2
Commandment #3
Commandment #5
Encryption & Key
Management
Entitlement
EKM-01 Keys must have identifiable owners (binding keys to identities) and there shall be key management policies. APO01.06
APO13.01
DSS05.04
DSS05.06
DSS06.03
DSS06.06
SRM > Cryptographic Services >
Key Management
Annex
A.10.1
A.10.1.1
A.10.1.2
Encryption & Key
Management
Key Generation
EKM-02 Policies and procedures shall be established for the management of cryptographic keys in the service's
cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the
customer (tenant) of changes within the cryptosystem,
especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared
responsibility over implementation of the control.

X X X X X X X X X S3.6.0
S3.4
(S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks. (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.7
CC5.6
L.6 38 (B)
39 (C+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-19 DS5.8 APO13.01 APO13.02
APO09.03
BAI06.01
BAI09.01
BAI09.02
BAI09.03
312.8 and
312.10
SRM > Cryptographic Services >
Key Management
shared x Domain 2 6.04.04. (a)

6.04.04. (b)

6.04.04. (c)

6.04.04. (d)

6.04.04. (e)

6.04.05. (d)

6.04.05. (e)

6.04.08.02. (b)
Article 17 NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-12
NIST SP 800-53 R3 SC-12 (2)
NIST SP 800-53 R3 SC-12 (5)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-17

8.1.1 8.2.1

8.2.5 45 CFR 164.312 (a)(2)(iv)
45 CFR 164.312(e)(1)
Clause 4.3.3
A.10.7.3
A.12.3.2
A.15.1.6
Clauses

5.2(c)

5.3(a)

5.3(b)

7.5.3(b)

7.5.3(d)

8.1 8.3

9.2(g)
A.8.2.3
A.10.1.2
A.18.1.5
Commandment #9
Commandment #10
Commandment #11
Architectural Relevance
Corp Gov
Relevance
Cloud Service Delivery Model
Applicability Supplier Relationship
CSA Enterprise Architecture
(formerly Trusted Cloud Initiative)
Control Domain CCM V3.0
Control ID Updated Control Specification
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 288
#15..
- 619 -
Encryption & Key
Management
Sensitive Data
Protection
EKM-03 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations), data in use (memory), and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.

XXXXXXXXXX C3.12.0
S3.6.0
S3.4
(C3.12.0, S3.6.0) Encryption or other equivalent security techniques are used to protect transmissions of user authentication and other confidential information passed over the Internet or other public networks.
(S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.7
CC5.6
G.4
G.15
I.3
G.10.4, G.11.1, G.11.2, G.12.1,
G.12.2, G.12.4, G.12.10, G.14.18,
G.14.19, G.16.2, G.16.18,
G.16.19, G.17.16, G.17.17,
G.18.13, G.18.14, G.19.1.1,
G.20.14
23 (B)
24 (B)
25 (B)
Schedule 1 (Section 5) 4.7 Safeguards, Subs. 4.7.3 IS-18 DS5.8 DS5.10
DS5.11
APO13.01
DSS05.02
DSS05.03
DSS06.06
312.8 and
312.10
SRM > Data Protection >
Cryptographic Services - Data-AtRest Encryption,
Cryptographic Services - Data-inTransit Encryption
sharedx Domain 2 6.04.05. (a)

6.04.05. (c)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 IA-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-8
NIST SP 800-53 R3 SC-8 (1)
NIST SP 800-53 R3 SC-9
NIST SP 800-53 R3 SC-9 (1)
NIST SP 800-53 R3 SC-13
NIST SP 800-53 R3 SC-13 (1)
NIST SP 800-53 R3 SC-23
NIST SP 800-53 R3 SC-28
NIST SP 800-53 R3 SI-8

8.1.1 8.2.1

8.2.5 45 CFR 164.312 (a)(2)(iv)
45 CFR 164.312 (e)(1)
45 CFR 164.312 (e)(2)(ii)
A.10.6.1
A.10.8.3
A.10.8.4
A.10.9.2
A.10.9.3
A.12.3.1
A.15.1.3
A.15.1.4
A.13.1.1
A.8.3.3
A.13.2.3
A.14.1.3
A.14.1.2
A.10.1.1
A.18.1.3
A.18.1.4
Commandment #4
Commandment #5
Commandment #9
Commandment #10
Commandment #11
Encryption & Key
Management
Storage and Access
EKM-04 Platform and data-appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key
management and key usage shall be separated duties.

XXXXXXX -- APO01.06
BAI09.02
BAI09.03
SRM > Cryptographic Services >
Key Management
sharedx Domain 11 Annex
A.10.1
A.10.1.1
A.10.1.2
Governance and Risk
Management
Baseline Requirements
GRM-01 Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal,
statutory and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use. Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and
authorized based on business need.

XXXXXXXXXXX S1.1.0
S1.2.0(a-i)
(S1.1.0) The entity’s security policies are established and periodically reviewed and approved by a designated individual or group.
(S1.2.0(a-i)) The entity's security policies include, but may not be limited to, the following matters:

CC3.2 L.2 L.2, L.5, L.7 L.8, L.9, L.10 12 (B)
14 (B)
13 (B)
15 (B)
16 (C+, A+)
21 (B)
Schedule 1 (Section 5), 4.7 - Safeguards IS-04 AI2.1
AI2.2
AI3.3
DS2.3
DS11.6
APO01.06
APO03.02
APO13.01
APO13.02
BAI02.01
BAI02.03
BAI02.04
BAI06.01
BAI10.01
BAI10.02
MEA02.01
312.8 and 312.10 SRM > Governance Risk &
Compliance > Technical Standards
sharedx Domain 2 6.03.01. (a)

6.03.04. (a)

6.03.04. (b)

6.03.04. (c)

6.03.04. (e)

6.07.01. (o)
Article 17 NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 CM-2
NIST SP 800-53 R3 CM-2 (1)
NIST SP 800-53 R3 CM-2 (3)
NIST SP 800-53 R3 CM-2 (5)
NIST SP 800-53 R3 SA-2
NIST SP 800-53 R3 SA-4
NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)
NIST SP 800-53 R3 SC-30

1.2.6 8.2.1

8.2.7 A.12.1.1
A.15.2.2
A.14.1.1
A.18.2.3
Commandment #2
Commandment #4
Commandment #5
Commandment #11
Governance and Risk
Management
Data Focus Risk
Assessments
GRM-02 Risk assessments associated with data governance requirements shall be
conducted at planned intervals and shall consider the
following:
• Awareness of where sensitive data is stored and transmitted across
applications, databases, servers, and network infrastructure • Compliance with defined retention periods and end-of-life disposal requirements
• Data classification and protection from unauthorized use, access, loss, destruction, and falsification
XXXXXXXXXX S3.1.0
C3.14.0
S1.2.b-c
(S3.1.0) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (C3.14.0) Procedures exist to provide that system data are classified in accordance with the defined confidentiality and related security policies.
(S1.2.b-c) b. Classifying data based on its criticality and sensitivity and that classification is used to define protection requirements, access rights and access restrictions, and retention and destruction policies.
c. Assessing risks on a periodic basis.

CC3.1
CC3.1
L.4, L.5, L.6, L.7 34 (B) Schedule 1 (Section 5), 4.7 - Safeguards DG-08 PO 9.1 PO 9.2
PO 9.4
DS 5.7
EDM03.02
APO01.03
APO12.01
APO12.02
APO12.03
APO12.04
BAI09.01
312.1 BOSS > Operational Risk
Management > Independent Risk
Management
sharedx Domain 5 6.01. (d)

6.04.03. (a)
Article 6, Article 8, Article 17 (1) NIST SP 800-53 R3 CA-3 NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SI-12

1.2.4 8.2.1
45 CFR 164.308(a)(1)(ii)(A)
45 CFR 164.308(a)(8)
Clause 4.2.1 c) & g)
Clause 4.2.3 d)
Clause 4.3.1 & 4.3.3
Clause 7.2 & 7.3
A.7.2
A.15.1.1
A.15.1.3
A.15.1.4
Clauses

5.2(c)

5.3(a)

5.3(b)

6.1.2 6.1.2(a)(2)

6.1.3(b)

7.5.3(b)

7.5.3(d)

8.1 8.2

8.3 9.2(g)
A.18.1.1
A.18.1.3
EAR 15
CFR §736.2
(b)
Commandment #1
Commandment #2
Commandment #3
Commandment #6
Commandment #7
Commandment #9
Commandment #10
Commandment #11
Governance and Risk
Management
Management Oversight
GRM-03 Managers are responsible for maintaining awareness of, and complying with, security policies, procedures, and standards that are relevant to their area of responsibility.

XXXXXX S1.2.f
S2.3.0
(S1.2.f) f. Assigning responsibility and accountability for system availability, confidentiality, processing integrity and related security. (S2.3.0) Responsibility and accountability for the entity’s system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2 E.1 E.4 5 (B)
65 (B)
Schedule 1 (Section 5) 4.1 Accountability; 4.7 Safeguards, Sub 4.7.4 IS-14 DS5.3 DS5.4
DS5.5
APO01.03
APO01.04
APO01.08
DSS01.01
312.8 and 312.10 BOSS > Human Resources Security
> Roles and Responsibilities
sharedx Domain 3, 9 NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-5
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 CA-7 (2)

1.1.2 8.2.1
Clause 5.2.2
A.8.2.1
A.8.2.2
A 11.2.4
A.15.2.1
Clause 7.2(a,b)
A.7.2.1
A.7.2.2
A.9.2.5
A.18.2.2
Commandment #6
Commandment #7
Commandment #8
Governance and Risk
Management
Management Program
GRM-04 An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business:
• Risk management
• Security policy
• Organization of information security
• Asset management
• Human resources security
• Physical and environmental security
• Communications and operations management
• Access control
• Information systems acquisition, development, and
XXXXXXXXXXXX x1.2. (x1.2.) The entity’s system [availability, processing integrity, confidentiality and related] security policies include, but may not be limited to, the following matters:

A.1, B.1 2 (B)
3 (B)
5 (B)
Schedule 1 (Section 5), 4.1 - Accountability; 4.7 Safeguards IS-01 R2 DS5.2 R2 DS5.5
APO13.01
APO13.02
APO13.03
312.8 and
312.10
SRM > InfoSec Management >
Capabilitiy Mapping
sharedx Domain 2 Article 17 99.31.(a)(1)(ii) 8.2.1 45 CFR 164.308(a)(1)(i) 45 CFR 164.308(a)(1)(ii)(B)
45 CFR 164.316(b)(1)(i)
45 CFR 164.308(a)(3)(i) (New)
45 CFR 164.306(a) (New)
Clause 4.2
Clause 5
A.6.1.1
A.6.1.2
A.6.1.3
A.6.1.4
A.6.1.5
A.6.1.6
A.6.1.7
A.6.1.8
All in sections 4, 5, 6, 7, 8, 9, 10.

A.6.1.1
A.13.2.4
A.6.1.3
A.6.1.4
A.18.2.1
Commandment #1
Commandment #2
Governance and Risk
Management
Management
Support/Involvement
GRM-05 Executive and line management shall take formal action to support
information security through clearly-documented direction and commitment, and shall ensure the action has been assigned.

XXXXX S1.3.0 (S1.3.0) Responsibility and accountability for developing and maintaining the entity’s system security policies, and changes and updates to those policies, are assigned.

The entity has prepared an objective description of the system and its boundaries and communicated such description to authorized users The security obligations of users and the entity’s security commitments to users are communicated to authorized users.

CC1.2 C.1 5 (B) Schedule 1 (Section 5), 4.1 Safeguards, Subsec. 4.1.1 IS-02 DS5.1 APO01.02 APO01.03
APO01.04
APO01.08
APO13.01
APO13.02
APO13.03
312.8 and
312.10
SRM > Governance Risk &
Compliance > Compliance
Management
sharedx Domain 2 Article 17 NIST SP 800-53 R3 CM-1 NIST SP 800-53 R3 CM-1 8.2.1 45 CFR 164.316 (b)(2)(ii) 45 CFR 164.316 (b)(2)(iii)
Clause 5
A.6.1.1
All in section 5 plus clauses

4.4 4.2(b)

6.1.2(a)(1)

6.2 6.2(a)

6.2(d)

7.1 7.4

9.3 10.2

7.2(a)
Commandment #3
Commandment #6
Governance and Risk
Management
Policy
GRM-06 Information security policies and procedures shall be established and
made readily available for review by all impacted personnel and external
business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic
business plan and an information security management
program inclusive of defined information security roles and responsibilities for business leadership.

XXXXXX S1.1.0
S1.3.0
S2.3.0
(S1.1.0) The entity's security policies are established and periodically reviewed and approved by a designated individual or group.
(S1.3.0) Responsibility and accountability for developing and maintaining the entity’s system security policies, and changes and updates to those policies, are assigned.
(S2.3.0) Responsibility and accountability for the entity's system security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2
CC1.2
CC2.3
B.1 Schedule 1 (Section 5) 4.1 Accountability, Subsec 4.1.4 IS-03 DS5.2 APO01.03 APO01.04
APO13.01
APO13.02
312.8 and
312.10
SRM > Policies and Standards >
Information Security Policies
sharedx Domain 2 6.02. (e) Article 17 NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

8.1.0 8.1.1
45 CFR 164.316 (a)
45 CFR 164.316 (b)(1)(i)
45 CFR 164.316 (b)(2)(ii)
45 CFR 164.308(a)(2)
Clause 4.2.1
Clause 5
A.5.1.1
A.8.2.2
Clause 4.3
Clause 5

4.4 4.2(b)

6.1.2(a)(1)

6.2 6.2(a)

6.2(d)

7.1 7.4

9.3 10.2

7.2(a)

7.2(b)

7.2(c)

7.2(d)

7.3(b)
Commandment #1
Commandment #2
Commandment #3
Governance and Risk
Management
Policy Enforcement
GRM-07 A formal disciplinary or sanction policy shall be established for employees who have violated security policies and
procedures. Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures.

XXXXXX S3.9
S2.4.0
(S3.9) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis.
(S2.4.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users.

CC6.2
CC2.5
B.1.5 Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4 IS-06 PO 7.7 APO01.03 APO01.08
APO07.04
312.8 and
312.10
SRM > Governance Risk &
Compliance >
sharedx Domain 2 Article 17 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-8

99.31(a)(i)(ii) 10.2.4 45 CFR 164.308 (a)(1)(ii)(C) A.8.2.3 A7.2.3 Commandment #6 Commandment #7
Governance and Risk
Management
Policy Impact on Risk
Assessments
GRM-08 Risk assessment results shall include updates to security policies,
procedures, standards, and controls to ensure that they remain relevant
and effective.

XXXXXXXXXXXX B.2
G.21
L.2
B.1.1, B.1.2, B.1.6, B.1.7.2, G.2,
L.9, L.10
Schedule 1 (Section 5), 4.7 - Safeguards RI-04 PO 9.6 APO12 APO13.01
APO13.03
312.8 and 312.10 BOSS > Operational Risk
Management > Risk Management
Framework
sharedx Domian 2, 4 6.03. (a) Article 17 (1), (2) NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
Clause 4.2.3
Clause 4.2.4
Clause 4.3.1
Clause 5
Clause 7
A.5.1.2
A.10.1.2
A.10.2.3
A.14.1.2
A.15.2.1
A.15.2.2
Clause

4.2.1 a,

4.2(b)

4.3 c,

4.3(a&b)

4.4 5.1(c)

5.1(d)

5.1(e)

5.1(f)

5.1(g)

5.1(h)

5.2 5.2 e,

5.2(f)

5.3 6.1.1(e)(2),

6.1.2(a)(1) Governance and Risk
Management
Policy Reviews
GRM-09 The organization's business leadership (or other accountable business
role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to
ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.

XXXXXX S1.1.0 (S1.1.0) The entity’s security policies are established and periodically reviewed and approved by a designated individual or group.

CC3.2 B.2 B.1.33. B.1.34, IS-05 DS 5.2
DS 5.4
APO12
APO13.01
APO13.03
MEA03.01
MEA03.02
312.8 and
312.10
SRM > Governance Risk &
Compliance > Policy Management
sharedx Domain 2 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

1.2.1 8.2.7

10.2.3 45 CFR 164.316 (b)(2)(iii)
45 CFE 164.306€
Clause 4.2.3 f)
A.5.1.2
Clause 8.1
A.5.1.2
Commandment #1
Commandment #2
Commandment #3
Governance and Risk
Management
Risk Assessments
GRM-10 Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at
planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods.

The likelihood and impact associated with inherent and
residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).

XXXXXXXXXXXX S3.1
x3.1.0
S4.3.0
(S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidenitality] commitments and (2) assess the risks associated with the identified threats. (S4.3.0) Environmental, regulatory, and technological changes are monitored, and their effect on system availability, confidentiality of data, processing integrity, and system security is assessed on a timely basis; policies are updated for that assessment.

CC3.1
CC3.3
I.1
I.4
C.2.1, I.4.1, I.5, G.15.1.3, I.3 46 (B)
74 (B)
Schedule 1 (Section 5), 4.7 - Safeguards RI-02 PO 9.4 APO12 312.8 and 312.10
BOSS > Operational Risk
Management > Risk Management
Framework
sharedx Domain 2, 4 6.03. (a)

6.08. (a)
Article 17 (1), (2) NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SC-30

1.2.4 1.2.5
45 CFR 164.308 (a)(1)(ii)(A) Clause 4.2.1 c) through g) Clause 4.2.3 d)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.5.2
A.12.6.1
A.14.1.2
A.15.1.1
A.15.2.1
A.15.2.2
Clause

4.2(b),

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1) Governance and Risk
Management
Risk Management
Framework
GRM-11 Risks shall be mitigated to an acceptable level. Acceptance levels based on risk criteria shall be established and
documented in accordance with reasonable resolution time frames and stakeholder approval.

XXXXXXXXXXXX S3.1
x3.1.0
(S3.1) Procedures exist to (1) identify potential threats of disruption to systems operation that would impair system security commitments and (2) assess the risks associated with the identified threats. (x3.1.0) Procedures exist to (1) identify potential threats of disruptions to systems operation that would impair system [availability, processing integrity, confidenitality] commitments and (2) assess the risks associated with the identified threats.

CC3.1 L.2 A.1, L.1 Schedule 1 (Section 5), 4.7 - Safeguards RI-01 PO 9.1 EDM03.02 APO01.03
APO12
312.8 and
312.10
BOSS > Operational Risk
Management > Risk Management
Framework
sharedx Domain 2, 4 Article 17 (1), (2) NIST SP 800-53 R3 AC-1 NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CA-6
NIST SP 800-53 R3 CA-7
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 RA-2
NIST SP 800-53 R3 RA-3
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 CM-1

1.2.4 45 CFR 164.308 (a)(8)
45 CFR 164.308(a)(1)(ii)(B)
Clause 4.2.1 c) through g)
Clause 4.2.2 b)
Clause 5.1 f)
Clause 7.2 & 7.3
A.6.2.1
A.12.6.1
A.14.1.2
A.15.2.1
A.15.2.2
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2)

6.1.2(d)

6.1.2(d)(1)

6.1.2(d)(2)

6.1.2(d)(3)

6.1.2(e)

6.1.2(e)(1)

6.1.2(e)(2)

6.1.3,

6.1.3(a) Human Resources
Asset Returns
HRS-01 Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period.

XXXXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 D.1 E.6.4 Schedule 1 (Section 5) 4.5 Limiting Use, Disclosure and Retention; 4.7 Safeguards, Subs. 4.7.5
IS-27 APO01.08
APO07.06
APO13.01
BAI09.03 312.3,
312.8 and
312.10
BOSS > Human Resources Security > Employee Termination provider x Domain 2 Article 17 NIST SP 800-53 R3 PS-4 NIST SP 800-53 R3 PS-4 5.2.3

7.2.2 8.2.1

8.2.6 45 CFR 164.308 (a)(3)(ii)(C) A.7.1.1
A.7.1.2
A.8.3.2
A.8.1.1
A.8.1.2
A.8.1.4
Human Resources
Background Screening
HRS-02 Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk.

XXXXXXX S3.11.0 (S3.11.0) Procedures exist to help ensure that personnel responsible for the design, development, implementation, and operation of systems affecting confidentiality and security have the qualifications and resources to fulfill their responsibilities.

CC1.3
CC1.4
E.2 E.2 63 (B) Schedule 1 (Section 5), 4.7 Safeguards, Subsec. 4.7.3 HR-01 PO 7.6 APO07.01 APO07.05
APO07.06
312.8 and 312.10 BOSS > Human Resources Security
> Background Screening
sharedx None 6.01. (a) Article 17 NIST SP 800-53 R3 PS-2 NIST SP 800-53 R3 PS-3
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-3

1.2.9 A.8.1.2 A.7.1.1 ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #2
Commandment #3
Commandment #6
Commandment #9
Human Resources
Employment
Agreements
HRS-03 Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or onboarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets.

XXXXXXXXXXXX S2.2.0 (S2.2.0) The security obligations of users and the entity's security commitments to users are communicated to authorized users CC2.2
CC2.3
C.1 E.3.5 66 (B) Schedule 1 (Section 5) 4.7 Safeguards, Subsec. 4.7.4 HR-02 DS 2.1 APO01.03 APO13.01
APO07.06
APO09.03
APO10.01
312.3,
312.8 and
312.10
BOSS > Human Resources Security
> Employee Code of Conduct
sharedx None Article 17 NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

1.2.9 8.2.6
45 CFR 164.310(a)(1)
45 CFR 164.308(a)(4)(i)
A.6.1.5
A.8.1.3
A.13.2.4
A.7.1.2
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Human Resources
Employment
Termination
HRS-04 Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.

XXXXXX S3.2.d
S3.8.e
(S3.2.d) Procedures exist to restrict logical access to the system and information resources maintained in the system including, but not limited to, the following matters:
d. The process to make changes and updates to user profiles (S3.8.e) e. Procedures to prevent customers, groups of individuals, or other entities from accessing confidential information other than their own
CC5.4 E.6 HR-03 PO 7.8 APO01.02
APO07.05
APO07.06
312.8 and
312.10
BOSS > Human Resources Security
> Roles and Responsibilities
sharedx None Article 17 NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-4
NIST SP 800-53 R3 PS-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-8

8.2.2 10.2.5
45 CFR 164.308 (a)(3)(ii)(C) A.8.3.1 A.7.3.1 Commandment #6 Commandment #7
Human Resources
Mobile Device
Management
HRS-05 Policies and procedures shall be established, and supporting business
processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the
implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring).

XXXXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 G.11, G12, G.20.13, G.20.14 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-32 DS5.11 DS5.5
APO01.08
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.07
DSS06.03
DSS06.06
312.8 and
312.10
Presentation Servies > Presentation
Platform > Endpoints - Mobile
Devices - Mobile Device
Management
sharedx Domain 2 Article 17 NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 AC-17
NIST SP 800-53 R3 AC-17 (1)
NIST SP 800-53 R3 AC-17 (2)
NIST SP 800-53 R3 AC-17 (3)
NIST SP 800-53 R3 AC-17 (4)
NIST SP 800-53 R3 AC-17 (5)
NIST SP 800-53 R3 AC-17 (7)
NIST SP 800-53 R3 AC-17 (8)
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 AC-19
NIST SP 800-53 R3 AC-19 (1)
NIST SP 800-53 R3 AC-19 (2)
NIST SP 800-53 R3 AC-19 (3)
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)
NIST SP 800-53 R3 MP-6
NIST SP 800-53 R3 MP-6 (4)

1.2.6 3.2.4

8.2.6 45 CFR 164.310 (d)(1) A.7.2.1
A.10.7.1
A.10.7.2
A.10.8.3
A.11.7.1
A.11.7.2
A.15.1.4
A.8.2.1
A.8.3.1
A.8.3.2
A.8.3.3
A.6.2.1
A.6.2.2
A.18.1.4
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
All
Human Resources
Non-Disclosure
Agreements
HRS-06 Requirements for non-disclosure or confidentiality agreements reflecting
the organization's needs for the protection of data and operational
details shall be identified, documented, and reviewed at XXXXXXX S4.1.0 (S4.1.0) The entity’s system availability, confidentiality, processing integrity and security performance is periodically reviewed and compared with the defined system availability and related security policies.

CC4.1 C.2.5 Schedule 1 (Section 5), 4.7 - Safeguards LG-01 APO01.02 APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
APO13.03 312.8 and 312.10 BOSS > Compliance > Intellectual Property Protection shared x Domain 3 Article 16 NIST SP 800-53 R3 PL-4 NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)

1.2.5 ISO/IEC 27001:2005
Annex A.6.1.5
A.13.2.4 ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
Commandment #6
Commandment #7
Commandment #8
Commandment #9
Human Resources
Roles / Responsibilities
HRS-07 Roles and responsibilities of contractors, employees, and third-party
users shall be documented as they relate to information assets and
security.

XXXXXXXXXXXX S1.2.f (S1.2.f) f. Assigning responsibility and accountability for system availability, confidentiality, processing integrity and related security.

B.1 B.1.5, D.1.1,D.1.3.3, E.1, F.1.1,
H.1.1, K.1.2
5 (B) Schedule 1 (Section 5) 4.1 Accountability IS-13 DS5.1 APO01.02 APO01.03
APO01.08
APO07.06
APO09.03
APO10.04
APO13.01
312.3, 312.8 and 312.10 BOSS > Human Resources Security > Roles and Responsibilities
sharedx Domain 2 Article 17 NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 PS-2
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

99.31(a)(1)(ii) 1.2.9

8.2.1 Clause 5.1 c)
A.6.1.2
A.6.1.3
A.8.1.1
Clause 5.3
A.6.1.1
A.6.1.1
Commandment #6
Commandment #7
Commandment #8
Human Resources
Technology Acceptable
Use
HRS-08 Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of
personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be
considered and incorporated as appropriate.

XXXXXXXX S1.2
S3.9
(S1.2) The entity’s security policies include, but may not be limited to, the following matters:
(S3.9) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis.

CC3.2
CC6.2
B.3 B.1.7, D.1.3.3, E.3.2, E.3.5.1,
E.3.5.2
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4 IS-26 DS 5.3 APO01.03 APO01.08
APO13.01
APO13.02
DSS05.04
DSS06.06
312.4,
312.8 and
312.10
SRM > Policies and Standards >
Information Security Policies
sharedx Domain 2 Article 5, Article 6
Article 7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AC-8
NIST SP 800-53 R3 AC-20
NIST SP 800-53 R3 AC-20 (1)
NIST SP 800-53 R3 AC-20 (2)
NIST SP 800-53 R3 PL-4

8.1.0 45 CFR 164.310 (b) A.7.1.3 A.8.1.3 Commandment #1 Commandment #2
Commandment #3
Human Resources
Training / Awareness
HRS-09 A security awareness training program shall be established for all
contractors, third-party users, and employees of the
organization and
mandated when appropriate. All individuals with access to organizational
data shall receive appropriate awareness training and
regular updates
in organizational procedures, processes, and policies
XXXXXXXXXXXX S1.2.k
S2.2.0
(S1.2.k) The entity's security policies include, but may not be limited to, the following matters:
k. Providing for training and other resources to support its system security policies
(S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users.

CC2.2
CC2.3
E.1 E.4 65 (B) Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.7 Safeguards, Subs. 4.7.4
IS-11 PO 7.4 APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
312.8 and
312.10
SRM > GRC > sharedx Domain 2 6.01. (c)

6.02. (e)
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4

99.31(a)(1)(ii) 1.2.10

8.2.1 45 CFR 164.308 (a)(5)(i)
45 CFR 164.308 (a)(5)(ii)(A)
Clause 5.2.2
A.8.2.2
Clause 7.2(a), 7.2(b)
A.7.2.2
Commandment #3
Commandment #6
Human Resources
User Responsibility
HRS-10 All personnel shall be made aware of their roles and responsibilities for:
• Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.
• Maintaining a safe and secure working environment
XXXXXXXXXXXX S2.3.0 (S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality, processing integrity and security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.

CC3.2 E.1 E.4 65 (B)
66 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.4 IS-16 PO 4.6 APO01.02 APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
312.8 and
312.10
BOSS > Human Resources Security
> Employee Awareness
sharedx Domain 2 Article 17 NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4
NIST SP 800-53 R3 AT-2
NIST SP 800-53 R3 AT-3
NIST SP 800-53 R3 AT-4
NIST SP 800-53 R3 PL-4

1.2.10 8.2.1
45 CFR 164.308 (a)(5)(ii)(D) Clause 5.2.2
A.8.2.2
A.11.3.1
A.11.3.2
Clause 7.2(a), 7.2(b)
A.7.2.2
A.9.3.1
A.11.2.8
Commandment #5
Commandment #6
Commandment #7
Human Resources
Workspace
HRS-11 Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions are disabled after an established period of inactivity.

XXXXXXXX S3.3.0
S3.4.0
(S3.3.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (S3.4.0) Procedures exist to protect against unauthorized access to system resources.

CC5.5
CC5.6
E.1 E.4 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-17 APO01.02 APO01.03
APO01.08
APO07.03
APO07.06
APO13.01
APO13.03
DSS05.03
DSS06.06 312.8 and 312.10 BOSS > Data Governance > Clear Desk Policy sharedx Domain 2 NIST SP 800-53 R3 MP-1 NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 MP-2
NIST SP 800-53 R3 MP-2 (1)
NIST SP 800-53 R3 MP-3
NIST SP 800-53 R3 MP-4
NIST SP 800-53 R3 MP-4 (1)

8.2.3 Clause 5.2.2
A.8.2.2
A.9.1.5
A.11.3.1
A.11.3.2
A.11.3.3
Clause 7.2(a), 7.2(b)
A.7.2.2
A.11.1.5
A.9.3.1
A.11.2.8
A.11.2.9
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #5
Commandment #6
Commandment #7
Commandment #11
Identity & Access
Management
Audit Tools Access
IAM-01 Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segmented and restricted to prevent compromise and misuse of log data.

XXXXXXXXXX S3.2.g (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

CC5.1 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-29 DS 5.7 APO01.03 APO01.08
APO13.01
APO13.02
DSS05.03
312.8 and 312.10 SRM > Privilege Management
Infrastructure > Privilege Usage
Management
sharedx Domain 2 6.03. (i)

6.03. (j)
NIST SP 800-53 R3 AU-9 NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-9 (2)

8.2.1 A.15.3.2 Commandment #2
Commandment #5
Commandment #11
Identity & Access
Management
Credential Lifecycle /
Provision Management
IAM-02 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and
customer (tenant) users with access to data and
organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and
measures must incorporate the following:
• Procedures and supporting roles and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customer-controlled access, suppliers' business
relationships, or other third-party business relationships) • Business case considerations for higher levels of
assurance and multi-factor authentication secrets (e.g., management interfaces, key generation, remote access,
segregation of duties, emergency access, large-scale
provisioning or geographically-distributed deployments, and personnel redundancy for critical systems)
• Access segmentation to sessions and data in multi-tenant architectures by any third party (e.g., provider and/or other customer (tenant))
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or reuse when feasible • Authentication, authorization, and accounting (AAA) rules for access to data and sessions (e.g., encryption and
strong/multi-factor, expireable, non-shared authentication XXXXXXXXXXX S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

B.1 B.1.8, B.1.21, B.1.28, E.6.2,
H.1.1, K.1.4.5,
8 (B)
40 (B)
41 (B)
42 (B)
43 (B)
44 (C+)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.7 Safeguards, Subs. 4.7.4
IS-07 DS 5.4 APO01.02
APO01.03
APO01.08
APO13.01
APO13.02
DSS05.04
DSS05.05
DSS05.06
DSS06.03
DSS06.06
312.8 and
312.10
SRM > Policies and Standards > sharedx Domain 2 6.01. (b)

6.01. (d)

6.02. (e)

6.03. (b)

6.03.04. (b)

6.03.04. (c)

6.03.05. (b)

6.03.05. (d)

6.03.06. (b)

6.04.01. (c)

6.04.01. (f)

6.04.02. (a)

6.04.02. (b)

6.04.02. (c)

6.04.03. (b)

6.04.06. (a)

6.04.08. (a)

6.04.08. (b)

6.04.08. (c)

6.04.08.03. (a)

6.04.08.03. (b)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-7
NIST SP 800-53 R3 AC-10
NIST SP 800-53 R3 AC-14
NIST SP 800-53 R3 IA-1

8.1.0 45 CFR 164.308 (a)(3)(i)
45 CFR 164.312 (a)(1)
45 CFR 164.312 (a)(2)(ii)
45 CFR 164.308(a)(4)(ii)(B)
45 CFR 164.308(a)(4)(ii)(c )
A.11.1.1
A.11.2.1
A.11.2.4
A.11.4.1
A.11.5.2
A.11.6.1
A.9.1.1
A.9.2.1,
A.9.2.2
A.9.2.5
A.9.1.2
A.9.4.1
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
Diagnostic /
Configuration Ports
Access
IAM-03 User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.

XXXXXXX S3.2.g (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

CC5.1 H1.1, H1.2, G.9.15 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-30 DS5.7 APO13.01 DSS05.02
DSS05.03
DSS05.05
DSS06.06
312.8 and 312.10 SRM > Privilege Management
Infrastructure > Privilege Usage
Management - Resource Protection
providerx Domain 2 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 MA-3
NIST SP 800-53 R3 MA-3 (1)
NIST SP 800-53 R3 MA-3 (2)
NIST SP 800-53 R3 MA-3 (3)
NIST SP 800-53 R3 MA-4
NIST SP 800-53 R3 MA-4 (1)
NIST SP 800-53 R3 MA-4 (2)
NIST SP 800-53 R3 MA-5
A.10.6.1
A.11.1.1
A.11.4.4
A.11.5.4
A.13.1.1
A.9.1.1
A.9.4.4
Commandment #3
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
Policies and
Procedures
IAM-04 Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access.

Policies shall also be developed to control access to network resources based on user identity.
-- APO01.03
APO01.08
APO13.01
APO13.02
DSS05.02
DSS05.04
SRM > Policies and Standards >
Information Security Policies
Domain 12 Annex
A.9.2
A.9.2.1
A.9.2.2
A.9.2.3,
A.9.2.4, Identity & Access
Management
Segregation of Duties
IAM-05 User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest.

XXXXXXXXXXX S3.2.a (S3.2.a) a. Logical access security measures to restrict access to information resources not deemed to be public.

CC5.1 G.2.13. G.3, G.20.1, G.20.2,
G.20.5
Schedule 1 (Section 5) 4.7 Safeguards, Subs. 4.7.3(b) IS-15 DS 5.4 APO01.03 APO01.08
APO13.02
DSS05.04
DSS06.03
312.8 and
312.10
ITOS > Resource Management >
Seggregation of Duties
sharedx Domain 2 6.04.01. (d)

6.04.08.02. (a)
Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)

99.31(a)(1)(ii) 8.2.2 45 CFR 164.308 (a)(1)(ii)(D)
45 CFR 164.308 (a)(3)(ii)(A)
45 CFR 164.308(a)(4)(ii)(A)
45 CFR 164.308 (a)(5)(ii)(C)
45 CFR 164.312 (b)
A.10.1.3 A.6.1.2 Commandment #6
Commandment #7
Commandment #8
Commandment #10
Identity & Access
Management
Source Code Access
Restriction
IAM-06 Access to the organization's own developed applications, program, or object source code, or any other form of
intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures.

XXXXXXXX S3.13.0 (S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.

CC7.4 I.2.7.2, I.2.9, I.2.10, I.2.15 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-33 APO01.03 APO01.08
APO13.02
DSS05.04
DSS06.03 ITOS > Service Support > Release Management - Source Code Management shared x Domain 2 Article 17 NIST SP 800-53 R3 CM-5 NIST SP 800-53 R3 CM-5 (1)
NIST SP 800-53 R3 CM-5 (5)

1.2.6 6.2.1
Clause 4.3.3
A.12.4.3
A.15.1.3
Clause

5.2(c)

5.3(a),

5.3(b),

7.5.3(b)

7.5.3(d)
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Commandment #9
Commandment #10
Identity & Access
Management
Third Party Access
IAM-07 The identification, assessment, and prioritization of risks posed by
business processes requiring third-party access to the
organization's
information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood
and impact of unauthorized or inappropriate access.

Compensating
controls derived from the risk analysis shall be implemented prior to
provisioning access.

CC3.1 B.1
H.2
B.1.1, B.1.2, D.1.1, E.1, F.1.1,
H.1.1, K.1.1, E.6.2, E.6.3
Schedule 1 (Section 5), 4.7 - Safeguards RI-05 DS 2.3 APO01.03 APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS05.07
DSS06.03
DSS06.06
312.8 and 312.10 SRM > Governance Risk &
Compliance > Vendor Management
sharedx Domain 2, 4 6.02. (a)

6.02. (b)

6.03. (a)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AT-1
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 CA-1
NIST SP 800-53 R3 CM-1
NIST SP 800-53 R3 CP-1
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 IR-1
NIST SP 800-53 R3 MA-1
NIST SP 800-53 R3 MP-1
NIST SP 800-53 R3 PE-1
NIST SP 800-53 R3 PL-1
NIST SP 800-53 R3 PS-1
NIST SP 800-53 R3 RA-1
NIST SP 800-53 R3 SA-1
NIST SP 800-53 R3 SC-1
NIST SP 800-53 R3 SI-1

7.1.1 7.1.2

7.2.1 7.2.2

7.2.3 7.2.4
A.6.2.1
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.4
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.5
Identity & Access
Management
Trusted Sources
IAM-08 Policies and procedures are established for permissible storage and
access of identities used for authentication to ensure identities are
only accessible based on rules of least privilege and
replication
limitation only to users explicitly defined as business necessary.

XXXXX S3.2.0
S4.3.0
(S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).
(S4.3.0) Environmental, regulatory, and technological changes are monitored, and their effect on system availability, confidentiality, processing integrity and security is assessed on a timely basis; policies are updated for that assessment.

CC3.3 IS-08
IS-12
APO01.03
APO01.08
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
312.8 and
312.10
Information Services > User
Directory Services > Active
Directory Services,
LDAP Repositories,
X.500 Repositories,
DBMS Repositories,
Meta Directory Services,
Virtual Directory Services
sharedx Domain 12 Annex
A.9.2,
A.9.2.1,
A.9.2.2,
A.9.2.3,
A.9.2.4,
A.9.2.5,
A.9.2.6,
A.9.3.1,
A.9.4.1,
A.9.4.2,
A.9.4.3,
A.9.4.5
Identity & Access
Management
User Access
Authorization
IAM-09 Provisioning user access (e.g., employees, contractors, customers
(tenants), business partners and/or supplier relationships) to data and
organizationally-owned or managed (physical and virtual) applications,
infrastructure systems, and network components shall be authorized by
the organization's management prior to access being granted and
appropriately restricted as per established policies and procedures.

Upon request, provider shall inform customer (tenant) of this user
access, especially if customer (tenant) data is used as part the service
and/or customer (tenant) has some shared responsibility over implementation of control.

XXXXXXXXXX S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
c. Registration and authorization of new users.
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

H.2.4, H.2.5, 35 (B)
40 (B)
41 (B)
42 (B)
44 (C+)
Schedule 1 (Section 5) Safeguards, Subs. 4.7.2 and 4.7.3 IS-08 DS5.4 APO01.03 APO01.08
APO07.06
APO10.04
APO13.02
DSS05.04
DSS06.03
DSS06.06
312.8 and
312.10
SRM > Privilege Management
Infrastructure > Identity Management
- Identity Provisioning
sharedx Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

6.03.06. (b)

6.04.01. (a)

6.04.01. (b)

6.04.01. (d)

6.04.01. (e)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)
Article 17 NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AC-3 (3)
NIST SP 800-53 R3 AC-5
NIST SP 800-53 R3 AC-6
NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-4
NIST SP 800-53 R3 IA-4 (4)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 MA-5
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 SA-7
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-9

8.2.2 45 CFR 164.308 (a)(3)(i)
45 CFR 164.308 (a)(3)(ii)(A)
45 CFR 164.308 (a)(4)(i)
45 CFR 164.308 (a)(4)(ii)(B)
45 CFR 164.308 (a)(4)(ii)(C)
45 CFR 164.312 (a)(1)
A.11.2.1
A.11.2.2
A.11.4.1
A 11.4.2
A.11.6.1
A.9.2.1, A.9.2.2
A.9.2.3
A.9.1.2
A.9.4.1
Commandment #6
Commandment #7
Commandment #8
Commandment #9
Commandment #10
Identity & Access
Management
User Access Reviews
IAM-10 User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to
demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access
violations, remediation must follow established user access policies and procedures.

XXXXXXXXXXX S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

H.2.6, H.2.7, H.2.9, 41 (B) Schedule 1 (Section 5), 4.7 - Safeguards IS-10 DS5.3 DS5.4
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
312.8 and
312.10
SRM > Privilege Management
Infrastructure > Authorization
Services - Entitlement Review
sharedx Domain 2 Article 17 NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-2 (1)
NIST SP 800-53 R3 AC-2 (2)
NIST SP 800-53 R3 AC-2 (3)
NIST SP 800-53 R3 AC-2 (4)
NIST SP 800-53 R3 AC-2 (7)
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 PS-6
NIST SP 800-53 R3 PS-7

99.31(a)(1)(ii) 8.2.1

8.2.7 45 CFR 164.308 (a)(3)(ii)(B)
45 CFR 164.308 (a)(4)(ii)(C)
A.11.2.4 A.9.2.5 ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Commandment #8
Commandment #10
Identity & Access
Management
User Access
Revocation
IAM-11 Timely de-provisioning (revocation or modification) of user access to
data and organizationally-owned or managed (physical and virtual)
applications, infrastructure systems, and network components, shall be
implemented as per established policies and procedures and based on
user's change in status (e.g., termination of employment or other
business relationship, job change or transfer). Upon request, XXXXXXXXXX S3.2.0 (S3.2.0) Procedures exist to restrict logical access to the defined system including, but not limited to, the following matters:
d. The process to make changes to user profiles.
g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

H.2 E.6.2, E.6.3 Schedule 1 (Section 5), 4.7 - Safeguards IS-09 DS 5.4 APO01.03 APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
312.8 and
312.10
SRM > Privilege Management
Infrastructure > Identity Management
- Identity Provisioning
sharedx Domain 2 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.03.06. (a)

99.31(a)(1)(ii) 8.2.1 45 CFR 164.308(a)(3)(ii)(C) ISO/IEC 27001:2005 A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.2
Annex A
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.3
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #6
Commandment #7
Commandment #8
Identity & Access
Management
User ID Credentials
IAM-12 Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures:
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or reuse when feasible • Adherence to industry acceptable and/or regulatory
compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets)
XXXXXXXXX S3.2.b (S3.2.b) b. Identification and authentication of users. CC5.3 B.1 H.5
E.6.2, E.6.3, H.1.1, H.1.2, H.2,
H.3.2, H.4, H.4.1, H.4.5, H.4.8
6 (B) Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-02 DS5.3 DS5.4
APO01.03
APO01.08
APO13.02
DSS05.04
DSS06.03
DSS06.06
MEA01.03
312.8 and
312.10
SRM > Policies and Standards >
Technical Securitry Standards
sharedx Domain 10 6.03.04. (b)

6.03.04. (c)

6.03.05. (d)

6.04.05. (b)
Article 17 (1), (2) NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-2
NIST SP 800-53 R3 AC-3
NIST SP 800-53 R3 AC-11
NIST SP 800-53 R3 AC-11 (1)
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-2 (3)
NIST SP 800-53 R3 AU-2 (4)
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 IA-1
NIST SP 800-53 R3 IA-2
NIST SP 800-53 R3 IA-2 (1)
NIST SP 800-53 R3 IA-2 (2)
NIST SP 800-53 R3 IA-2 (3)
NIST SP 800-53 R3 IA-2 (8)
NIST SP 800-53 R3 IA-5
NIST SP 800-53 R3 IA-5 (1)
NIST SP 800-53 R3 IA-5 (2)
NIST SP 800-53 R3 IA-5 (3)
NIST SP 800-53 R3 IA-5 (6)
NIST SP 800-53 R3 IA-5 (7)
NIST SP 800-53 R3 IA-6
NIST SP 800-53 R3 IA-8
NIST SP 800-53 R3 SC-10

99.3 99.31(a)(1)(ii)
45 CFR 164.308(a)(5)(ii)(c)
45 CFR 164.308 (a)(5)(ii)(D)
45 CFR 164.312 (a)(2)(i)
45 CFR 164.312 (a)(2)(iii)
45 CFR 164.312 (d)
A.8.3.3
A.11.1.1
A.11.2.1
A.11.2.3
A.11.2.4
A.11.5.5
A.9.2.6
A.9.1.1
A.9.2.1, A.9.2.2
A.9.2.4
A.9.2.5
A.9.4.2
Commandment #6
Commandment #7
Commandment #8
Commandment #9
Identity & Access
Management
Utility Programs
Access
IAM-13 Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted.

XXXXXXXXXX S3.2.g (S3.2.g) g. Restriction of access to system configurations, superuser functionality, master passwords, powerful utilities, and security devices (for example, firewalls).

CC5.1 H.2.16 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-34 DS5.7 APO13.01 APO13.02
DSS05.05
312.8 and 312.10 SRM > Privilege Management
Infrastructure > Privilege Usage
Management - Resource Protection
sharedx Domain 2 NIST SP 800-53 R3 CM-7 NIST SP 800-53 R3 AC-6 NIST SP 800-53 R3 AC-6 (1)
NIST SP 800-53 R3 AC-6 (2)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
A.11.4.1
A 11.4.4
A.11.5.4
A.9.1.2 Deleted
A.9.4.4
Commandment #1
Commandment #5
Commandment #6
Commandment #7
Infrastructure &
Virtualization Security
Audit Logging /
Intrusion Detection
IVS-01 Higher levels of assurance are required for protection, retention, and
lifecyle management of audit logs, adhering to applicable legal,
statutory or regulatory compliance obligations and providing unique user
access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic
investigative capabilities in the event of a security breach.

XXXXXXXXXXX S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other incidents.

CC6.2 G.7
G.8
G.9
J.1
L.2
G.14.7, G.14.8, G.14.9,
G.14.10,G.14.11, G.14.12,
G.15.5, G.15.7, G.15.8, G.16.8,
G.16.9, G.16.10, G.15.9, G.17.5,
G.17.7, G.17.8, G.17.6, G.17.9,
G.18.2, G.18.3, G.18.5, G.18.6,
G.19.2.6, G.19.3.1, G.9.6.2,
G.9.6.3, G.9.6.4, G.9.19, H.2.16,
H.3.3, J.1, J.2, L.5, L.9, L.10
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-14 DS5.5 DS5.6
DS9.2
APO13.01
APO13.02
BAI10.01
BAI10.02
BAI10.03
DSS01.03
DSS02.01
DSS05.07
DSS06.05
312.3,
312.8 and
312.10
BOSS > Security Monitoring
Services > SIEM
sharedx Domain 10 6.03. (i)

6.03. (j)

6.03.03. (a)

6.03.03. (d)

6.03.04. (e)

6.04.07. (a)

6.07.01. (a)

6.07.01. (c)
Article 17 NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-3
NIST SP 800-53 R3 AU-4
NIST SP 800-53 R3 AU-5
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 AU-12
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-2
NIST SP 800-53 R3 AU-2 (3)
NIST SP 800-53 R3 AU-2 (4)
NIST SP 800-53 R3 AU-3
NIST SP 800-53 R3 AU-3 (1)
NIST SP 800-53 R3 AU-4
NIST SP 800-53 R3 AU-5
NIST SP 800-53 R3 AU-6
NIST SP 800-53 R3 AU-6 (1)
NIST SP 800-53 R3 AU-6 (3)
NIST SP 800-53 R3 AU-7
NIST SP 800-53 R3 AU-7 (1)
NIST SP 800-53 R3 AU-9
NIST SP 800-53 R3 AU-11
NIST SP 800-53 R3 AU-12
NIST SP 800-53 R3 PE-2
NIST SP 800-53 R3 PE-3
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SC-18

8.2.1 8.2.2
45 CFR 164.308 (a)(1)(ii)(D)
45 CFR 164.312 (b)
45 CFR 164.308(a)(5)(ii)©
A.10.10.1
A.10.10.2
A.10.10.3
A.10.10.4
A.10.10.5
A.11.2.2
A.11.5.4
A.11.6.1
A.13.1.1
A.13.2.3
A.15.2.2
A.15.1.3
A.12.4.1
A.12.4.1
A.12.4.2, A.12.4.3
A.12.4.3
A.12.4.1
A.9.2.3
A.9.4.4
A.9.4.1
A.16.1.2
A.16.1.7
A.18.2.3
A.18.1.3
Commandment #6
Commandment #7
Commandment #11
Infrastructure &
Virtualization Security
Change Detection
IVS-02 The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g. dormant, off, or running). The results of a change or move of an image and the subsequent
validation of the image's integrity must be immediately available to customers through electronic methods (e.g. portals or alerts).

APO08.04
APO13.01
BAI06.01
BAI06.02
BAI10.03
BAI10.04
SRM > Privilege Management
Infrastructure > Privileged Usage
Management -> Hypervisor
Governance and Compliance
Annex
A.12.1.2
A.12.4,
A.12.4.1,
A.12.4.2,
A.12.4.3,
A.12.6.1,
A.12.6.2, Infrastructure &
Virtualization Security
Clock Synchronization
IVS-03 A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.

XXXXXXX S3.7 (S3.7) Procedures exist to identify, report, and act upon system security breaches and other incidents.

CC6.2 G.7
G.8
G.13, G.14.8, G.15.5, G.16.8,
G.17.6, G.18.3, G.19.2.6,
G.19.3.1
20 (B)
28 (B)
30 (B)
35 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-12 DS5.7 APO01.08 APO13.01
APO13.02
BAI03.05
DSS01.01
312.8 and
312.10
Infra Services > Network Services >
Authoritative Time Source
providerx Domain 10 6.03. (k) NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-1
NIST SP 800-53 R3 AU-8
NIST SP 800-53 R3 AU-8 (1)
A.10.10.1
A.10.10.6
A.12.4.1
A.12.4.4
Infrastructure &
Virtualization Security
Information System
Documentation
IVS-04 The availability, quality, and adequate capacity and resources shall be planned, prepared, and measured to deliver the required system performance in accordance with legal,
statutory, and regulatory compliance obligations. Projections of future capacity requirements shall be made to mitigate the risk of system overload.

XXXXXXXXX A3.2.0
A4.1.0
(A3.2.0) Measures to prevent or mitigate threats have been implemented consistent with the risk assessment when commercially practicable.
(A4.1.0) The entity’s system availability and security performance is periodically reviewed and compared with the defined system availability and related security policies.

A1.1
A1.2
CC4.1
G.5 OP-03 DS 3 APO01.03
APO01.08
BAI04.01
BAI04.04
BAI04.05
BAI10.01
BAI10.02
312.8 and 312.10 ITOS > Service Delivery >
Information Technology Resiliency -
Capacity Planning
providerx Domain 7, 8 6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

6.03.07. (d)
Article 17 (1) NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 NIST SP 800-53 R3 SA-4 (1)
NIST SP 800-53 R3 SA-4 (4)
NIST SP 800-53 R3 SA-4 (7)

1.2.4 A.10.3.1 A.12.1.3 Commandment #1
Commandment #2
Commandment #3
Infrastructure &
Virtualization Security
Management -
Vulnerability
Management
IVS-05 Implementers shall ensure that the security vulnerability assessment
tools or services accommodate the virtualization technologies used (e.g.
virtualization aware).

XXXXX -- APO01.08
APO04.02
APO04.03
APO04.04
DSS05.03
DSS06.06
SRM > Threat and Vulnerability
Management > Vulnerability
Management
providerx Domain 1, 13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b) Infrastructure &
Virtualization Security
Network Security
IVS-06 Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, and ports, and by compensating controls.

XXXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 G.2
G.4
G.15
G.16
G.17
G.18
I.3
G.9.17, G.9.7, G.10, G.9.11,
G.14.1, G.15.1, G.9.2, G.9.3,
G.9.13
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-08 APO03.01 APO03.02
APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
BAI03.05
DSS05.02
DSS06.06
312.8 and
312.10
SRM > Infrastructure Protection
Services > Network
providerx Domain 10 6.03.03. (a)

6.03.03. (d)

6.03.04. (d)

6.04.07. (a)

6.07.01. (c)
Article 17 NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 CM-7
NIST SP 800-53 R3 CM-7 (1)
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
NIST SP 800-53 R3 SC-20 (1)
NIST SP 800-53 R3 SC-21
NIST SP 800-53 R3 SC-22
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SC-32

8.2.5 A.10.6.1
A.10.6.2
A.10.9.1
A.10.10.2
A.11.4.1
A.11.4.5
A.11.4.6
A.11.4.7
A.15.1.4
A.13.1.1
A.13.1.2
A.14.1.2
A.12.4.1
A.9.1.2
A.13.1.3
A.18.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment #10
Commandment #11
Infrastructure &
Virtualization Security
OS Hardening and
Base Conrols
IVS-07 Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.

XXXXXXX -- APO13.01
APO13.02
BAI02.01
BAI03.02
BAI03.03
BAI03.04
SRM > Policies and Standards >
Operational Security Baselines
sharedx Domain 1, 13 Annex
A.12.1.4
A.12.2.1
A.12.4.1
A.12.6.1
Infrastructure &
Virtualization Security
Production / NonProduction
Environments
IVS-08 Production and non-production environments shall be separated to prevent unauthorized access or changes to
information assets. Separation of the environments may
include: stateful inspection firewalls, domain/realm
authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.

XXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 B.1 I.2.7.1, I.2.20, I.2.17, I.2.22.2,
I.2.22.4, I.2.22.10-14, H.1.1
22 (B) Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-06 DS5.7 APO03.01 APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and
312.10
Information Services > Data
Governance > Data Segregation
sharedx Domain 10 6.03. (d) NIST SP 800-53 R3 SC-2 1.2.6 A.10.1.4 A.10.3.2
A.11.1.1
A.12.5.1
A.12.5.2
A.12.5.3
A.12.1.4
A.14.2.9
A.9.1.1

8.1,partial, A.14.2.2

8.1,partial, A.14.2.3

8.1,partial, A.14.2.4
Commandment #1
Commandment #10
Commandment #11
Infrastructure &
Virtualization Security
Segmentation
IVS-09 Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations:
• Established policies and procedures
• Isolation of business critical assets and/or sensitive user data, and sessions that mandate stronger internal controls and high levels of assurance
• Compliance with legal, statutory and regulatory compliance obligations
XXXXXXXXXXX S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 G.17 G.9.2, G.9.3, G.9.13 Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-09 DS5.10 APO03.01 APO03.02
APO13.01
APO13.02
DSS05.02
DSS05.05
DSS06.06
312.8 and
312.10
SRM > Infrastructure Protection
Services > Network - Firewall
providerx Domain 10 6.03.03. (b)

6.03.05. (a)

6.03.05. (b)

6.04.01. (a)

6.04.01. (g)

6.04.03. (c)

6.04.08.02. (a)

6.04.08.02. (b)

6.05. (c)
Article 17 NIST SP 800-53 R3 SC-7 NIST SP 800-53 R3 AC-4 NIST SP 800-53 R3 SC-2
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)
45 CFR 164.308 (a)(4)(ii)(A) A.11.4.5
A.11.6.1
A.11.6.2
A.15.1.4
A.13.1.3
A.9.4.1
A.18.1.4
Commandment #1
Commandment #2
Commandment #3
Commandment #9
Commandment #10
Commandment #11
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 289
#15..
- 620 -
Infrastructure &
Virtualization Security
VM Security - vMotion
Data Protection
IVS-10 Secured and encrypted communication channels shall be used when
migrating physical servers, applications, or data to virtualized servers
and, where possible, shall use a network segregated from production-level networks for such migrations.

X X X X X -- APO03.01
APO03.02
APO03.04
APO13.01
APO13.02
DSS05.02
DSS05.05
SRM > Cryptographic Services >
Data-in-transit Encryption
provider X Domain 1, 13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b) Infrastructure &
Virtualization Security
VMM Security -
Hypervisor Hardening
IVS-11 Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated
communications to the administrative consoles).

X X X X X X X X X X -- APO13.01
APO13.02
DSS05.02
DSS05.04
DSS06.03
DSS06.06
SRM > Privilege Mangement
Infrastructure > Privilege Use
Management - Hypervisor
Governance and Compliance
provider X Domain 1, 13 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b) Infrastructure &
Virtualization Security
Wireless Security
IVS-12 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the
following:
• Perimeter firewalls implemented and configured to restrict unauthorized traffic
• Security settings enabled with strong encryption for
authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP
community strings)
• User access to wireless network devices restricted to authorized personnel
• The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network
X X X X X X X X X X X X S3.4 (S3.4) Procedures exist to protect against unauthorized access to system resources.

CC5.6 D.1
B.3
F.1
G.4
G.15
G.17
G.18
E.3.1, F.1.2.4, F.1.2.5, F.1.2.6,
F.1.2.8, F.1.2. 9, F.1.2.10,
F.1.2.11, F.1.2.12, F.1.2.13,
F.1.2.14, F.1.2.15, F.1.2.24,
F.1.3, F.1.4.2, F1.4.6, F.1.4.7,
F.1.6, F.1.7,F.1.8, F.2.13, F.2.14,
F.2.15, F.2.16, F.2.17, F.2.18
G.9.17, G.9.7, G.10, G.9.11,
G.14.1, G.15.1, G.9.2, G.9.3,
G.9.13
40 (B)
44 (C+)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 SA-10 DS5.5 DS5.7
DS5.8
DS5.10
APO01.08
APO13.01
APO13.02
DSS02.02
DSS05.02
DSS05.03
DSS05.04
DSS05.05
DSS05.07
DSS06.03
DSS06.06
312.8 and
312.10
SRM > Infrastructure Protection
Services > Network - Wireless
Protection
provider X Domain 10 Article 17 NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 AC-1
NIST SP 800-53 R3 AC-18
NIST SP 800-53 R3 AC-18 (1)
NIST SP 800-53 R3 AC-18 (2)
NIST SP 800-53 R3 CM-6
NIST SP 800-53 R3 CM-6 (1)
NIST SP 800-53 R3 CM-6 (3)
NIST SP 800-53 R3 PE-4
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)

8.2.5 45 CFR 164.312 (e)(1)(2)(ii)
45 CFR 164.308(a)(5)(ii)(D)
45 CFR 164.312(e)(1)
45 CFR 164.312(e)(2)(ii)
A.7.1.1
A.7.1.2
A.7.1.3
A.9.2.1
A.9.2.4
A.10.6.1
A.10.6.2
A.10.8.1
A.10.8.3
A.10.8.5
A.10.10.2
A.11.2.1
A.11.4.3
A.11.4.5
A.11.4.6
A.11.4.7
A.12.3.1
A.12.3.2
A.8.1.1
A.8.1.2
A.8.1.3
A.11.2.1
A.11.2.4
A.13.1.1
A.13.1.2
A.13.2.1
A.8.3.3
A.12.4.1
A.9.2.1, A.9.2.2
A.13.1.3
A.10.1.1
A.10.1.2
Commandment #1
Commandment #2
Commandment #3
Commandment #4
Commandment #5
Commandment #9
Commandment #10
Commandment #11
Infrastructure &
Virtualization Security
Network Architecture
IVS-13 Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks.

Interoperability &
Portability
APIs
IPY-01 The provider shall use open and published APIs to ensure support for interoperability between components and to
facilitate migrating applications.

X X X X X X X X X -- BAI02.04
BAI03.01
BAI03.02
BAI03.03
Application Services >
Programming Interfaces >
provider X Domain 6 Clause

6.1.1,

6.1.1(e)(2)
Interoperability & 6.1.2
Portability
Data Request
IPY-02 All structured and unstructured data shall be available to the customer and provided to them upon request in an industrystandard format (e.g., .doc, .xls, .pdf, logs, and flat files) X X X X X X X X X -- APO01.03
APO01.06
APO03.01
APO08.01
Information Services > Reporting
Services >
provider Domain 6 Clause

6.1.1,

6.1.1(e)(2)
Interoperability & 6.1.2
Portability
Policy & Legal
IPY-03 Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage, and integrity persistence.

X X X X X X X X X X X X --
APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
BAI02.04
APO09.03
Information Technology Operation
Services > Service Delivery >
Service Level Management -
External SLA's provider
Domain 3 6.04.03. (b)

6.04.08. (a)

6.04.08. (b)

6.06. (a)

6.06. (b)

6.06. (c)

6.06. (d)

6.06. (e)

6.06. (f)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)

6.1.2(c)(1),

6.1.2(c)(2) Interoperability &
Portability
Standardized Network
Protocols
IPY-04 The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.

X X X X X X -- APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
SRM > Data Protection >
Cryptographic Services - Data-InTransit Encryption
provider x Domain 6 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2), Interoperability &
Portability
Virtualization
IPY-05 The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use and all solutionspecific virtualization hooks available for customer review.

X X X X X X X X X -- APO01.08
APO02.05
APO03.01
APO03.02
APO04.02
BAI02.01
Infrastructure Services > Virtual
Infrastructure > Server Virtualization
provider X Domain 6 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Anti-Malware
MOS-01 Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training.

X X X X X X -- APO01.03
APO13.01
APO07.03
APO07.06
SRM > Governance Risk &
Compliance > Technical Awareness
and Training
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Application Stores
MOS-02 A documented list of approved application stores has been defined as acceptable for mobile devices accessing or storing provider managed data.

X X X X X X -- APO01.04
APO01.08
APO04.02
APO13.01
APO13.02
SRM > Policies and Standards >
Technical Securitry Standards
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 Mobile Security 6.1.2(a)(1)
Approved Applications
MOS-03 The company shall have a documented policy prohibiting the installation of non-approved applications or approved
applications not obtained
through a pre-identified application store.

X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
ITOS > Service Support >
Configuration Management -
Software Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Approved Software for
BYOD
MOS-04 The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage.

X X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
SRM > Policies and Standards >
Technical Securitry Standards
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Awareness and
Training
MOS-05 The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices.

The provider shall post and communicate the policy and
requirements through the company's security awareness and training program.

X X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
APO13.03
SRM > Policies and Standards >
Technical Securitry Standards
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Cloud Based Services
MOS-06 All cloud-based services used by the company's mobile devices or BYOD
shall be pre-approved for usage and the storage of company business
X X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
SRM > Governance Risk &
Compliance > Vendor Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Compatibility
MOS-07 The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues.

X X X X X X -- APO01.03
APO01.08
APO13.01
APO13.02
ITOS > Service Support >
Configuration Management -
Software Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Device Eligibility
MOS-08 The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage.

X X X X X X -- APO01.03
APO01.08
APO13.01
SRM > Policies and Standards >
Information Security Policies
provider X None (Mobile
Guidance)
Clause

6.1.1,
Mobile Security 6.1.1(e)(2)
Device Inventory
MOS-09 An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD)) will be included for each device in the inventory.

X X X X X X -- BAI06.01
BAI06.02
BAI06.04
BAI10.01
BAI10.02
BAI10.03
SRM > Infrastructure Protection
Services > End Point - Inventory
Control
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Mobile Security 6.1.2(b)
Device Management
MOS-10 A centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data.

X X X X X X X X X X X -- APO03.01
APO03.02
APO04.02
APO13.01
Presentation Servies > Presentation
Platform > End-Points-Mobile
Devices-Mobile Device
Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Encryption
MOS-11 The mobile device policy shall require the use of encryption either for
the entire device or for data identified as sensitive on all mobile
X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
SRM > Data Protection >
Cryptographic Services - Data-AtRest Encryption
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Jailbreaking and
Rooting
MOS-12 The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g. jailbreaking or rooting) and shall enforce the prohibition through detective and preventative controls on the device or through a
centralized device management system (e.g. mobile device management).

X X X X X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
Presentation Servies > Presentation
Platform > End-Points-Mobile
Devices-Mobile Device
Management
provider X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Legal
MOS-13 The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds. The BYOD policy shall clearly state the expectations regarding the loss of non-company data in the case a wipe of the device is required.

X X X X X X X X X -- APO01.03
APO13.01
APO13.02
SRM > Policies and Standards >
Information Security Services
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Lockout Screen
MOS-14 BYOD and/or company-owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls.

X X X X X X X X -- DSS05.03
DSS05.05
Presentation Servies > Presentation
Platform > End-Points-Mobile
Devices-Mobile Device
Management
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Operating Systems
MOS-15 Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes.

X X X X X X X X X -- APO01.03
APO13.01
APO13.02
BAI06
ITOS > Service Support -Change
Management > Planned Changes
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)
Mobile Security 6.1.2
Passwords
MOS-16 Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/PIN lengths and authentication requirements.

X X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
Presentation Servies > Presentation
Platform > End-Points-Mobile
Devices-Mobile Device
Management
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Mobile Security 6.1.2(a)(2),
Policy
MOS-17 The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported).

X X X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.03
SRM > Policies and Standards >
Technical Securitry Standards
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 Mobile Security 6.1.2(a)(1)
Remote Wipe
MOS-18 All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall
allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's
corporate IT.

X X X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
BOSS > Data Governance > Secure
Disposal of Data
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 Mobile Security 6.1.2(a)(1)
Security Patches
MOS-19 Mobile devices connecting to corporate networks, or storing and accessing company information, shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these
updates remotely.

X X X X X X X -- APO01.03
APO13.01
APO13.02
DSS05.03
DSS05.05
DSS05.06
SRM > Infrastructure Protection
Services->Network > Link Layer
Network Security
shared X None (Mobile
Guidance)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Mobile Security 6.1.2(b)
Users
MOS-20 The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device.

X X X X X X X -- APO01.03
APO13.01
APO13.02
SRM > Policies and Standards >
Technical Security Standards
shared X None (Mobile
Guidance)
Clause

6.1.1,
Security Incident 6.1.1(e)(2)
Management, EDiscovery & Cloud
Forensics
Contact / Authority
Maintenance
SEF-01 Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impacted-scope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement.

X X X X X X X X X X X X S4.3.0
x4.4.0
(S4.3.0) Environmental, regulatory, and technological changes are monitored and their effect on system security is assessed on a timely basis and policies are updated for that assessment.
(x4.4.0) Environmental, regulatory, and technological changes are monitored, and their impact on system [availability, processing integrity, confidentiality] and security is assessed on a timely basis.

System [availability, processing integrity, confidentiality] policies and procedures are updated for such changes as required.

CC3.3 L1 CO-04 ME 3.1 APO01.01
APO01.02
APO01.03
APO01.08
MEA03.01
MEA03.02
MEA03.03
312.4 BOSS > Compliance >
Contact/Authority Maintenance
shared x Domain 2, 4 NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-6 (1)
NIST SP 800-53 R3 SI-5

1.2.7 10.1.1

10.2.4 A.6.1.6
A.6.1.7
A.6.1.3
A.6.1.4
Commandment #1
Commandment #2
Commandment #3
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Management
SEF-02 Policies and procedures shall be established, and supporting business
processes and technical measures implemented, to triage security-related events and ensure timely and thorough
incident management, as per established IT service
management policies and procedures.

X X X X X X X X X X X X IS3.7.0
S3.9.0
(IS3.7.0) Procedures exist to identify, report, and act upon system security breaches and other incidents.
(S3.9.0) Procedures exist to provide that issues of noncompliance with system availability, confidentiality of data, processing integrity and related security policies are promptly addressed and that corrective measures are taken on a timely basis.

CC5.5
CC6.2
J.1 J.1.1, J.1.2 46 (B) Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.4; 4.8 Openness, Subs. 4.8.2
IS-22 DS5.6 APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
312.8 and
312.10
ITOS > Service Support > Security
Incident Management
shared x Domain 2 6.04.07. (b)

6.07.01. (a)

6.07.01. (d)

6.07.01. (e)

6.07.01. (f)

6.07.01. (g)

1.2.4 1.2.7

7.1.2 7.2.2

7.2.4 10.2.1

10.2.4 45 CFR 164.308 (a)(1)(i)
45 CFR 164.308 (a)(6)(i)
Clause 4.3.3
A.13.1.1
A.13.2.1
Clause

5.3 (a),

5.3 (b),

7.5.3(b),

5.2 (c),

7.5.3(d),

8.1,

8.3,

9.2(g),
Annex
A.16.1.1
ITAR 22
CFR §
127.12
Commandment #2
Commandment #6
Commandment #8
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Reporting
SEF-03 Workforce personnel and external business relationships shall be informed of their responsibilities and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications
channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations.

X X X X X X X X X X X X A2.3.0
C2.3.0
I2.3.0
S2.3.0
S2.4
C3.6.0
(A2.3.0, C2.3.0, I2.3.0, S2.3.0) Responsibility and accountability for the entity’s system availability, confidentiality of data, processing integrity and related security policies and changes and updates to those policies are communicated to entity personnel responsible for implementing them.
(S2.4) The process for informing the entity about breaches of the system security and for submitting complaints is communicated to authorized users.
(C3.6.0) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies.

CC2.3
CC2.5
C1.4
C1.5
J.1
E.1
J.1.1, E.4 5 (B)
46 (B)
48 (A+)
49 (B)
50 (B)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3 IS-23 DS5.6 APO01.03 APO07.06
APO07.03
APO13.01
APO13.02
DSS02.01
312.3,
312.8 and
312.10
BOSS > Human Resources Security
> Employee Awareness
shared x Domain 2 6.07.01. (a) Article 17 NIST SP 800-53 R3 IR-2 NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 IR-2
NIST SP 800-53 R3 IR-6
NIST SP 800-53 R3 IR-6 (1)
NIST SP 800-53 R3 IR-7
NIST SP 800-53 R3 IR-7 (1)
NIST SP 800-53 R3 IR-7 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-4 (2)
NIST SP 800-53 R3 SI-4 (4)
NIST SP 800-53 R3 SI-4 (5)
NIST SP 800-53 R3 SI-4 (6)
NIST SP 800-53 R3 SI-5

99.31(a)(1)(i)
34 CFR 99.32(a)

1.2.7 1.2.10

7.1.2 7.2.2

7.2.4 10.2.4
45 CFR 164.312 (a)(6)(ii)
16 CFR 318.3 (a)
16 CFR 318.5 (a)
45 CFR 160.410 (a)(1)
Clause 4.3.3
Clause 5.2.2
A.6.1.3
A.8.2.1
A.8.2.2
A.13.1.1
A.13.1.2
A.13.2.1
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),

7.3(c)

7.5.3(b),

7.5.3(d),

8.1,

8.3,

9.2(g)
Annex
A.6.1.1
A.7.2.1,
ITAR 22
CFR §
127.12
Commandment #2
Commandment #6
Commandment #8
Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Legal Preparation
SEF-04 Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation.

X X X X X X X X X X X X S2.4.0
C3.15.0
(S2.4.0) The process for informing the entity about system availability issues, confidentiality issues, processing integrity issues, security issues and breaches of the system security and for submitting complaints is communicated to authorized users.
(C3.15.0) Procedures exist to provide that issues of noncompliance with defined confidentiality and related security policies are promptly addressed and that corrective measures are taken on a timely basis.

CC2.5
CC6.2
J.1
E.1
J.1.1, J.1.2, E.4 IS-24 DS5.6 APO01.03
APO13.01
APO13.02
DSS01.03
DSS02.01
DSS02.02
DSS02.04
DSS02.05
DSS02.06
312.8 and
312.10
BOSS > Legal Services > Incident
Response Legal Preparation
shared x Domain 2 6.04.07. (b)

6.07.01. (f)

1.2.7 45 CFR 164.308 (a)(6)(ii) Clause 4.3.3
Clause 5.2.2
A.8.2.2
A.8.2.3
A.13.2.3
A.15.1.3
Clause

5.2 (c),

5.3 (a),

5.3 (b),

7.2(a),

7.2(b),

7.2(c),

7.2(d),

7.3(b),

7.3(c)

7.5.3(b),

7.5.3(d),

8.1,

8.3,

9.2(g)
Annex
A.7.2.2,
A.7.2.3,
A.16.1.7, Security Incident
Management, EDiscovery & Cloud
Forensics
Incident Response
Metrics
SEF-05 Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

X X X X X X X X X X X X S3.9.0
C4.1.0
(S3.9.0) Procedures exist to provide that issues of noncompliance with security policies are promptly addressed and that corrective measures are taken on a timely basis.
(C4.1.0) The entity’s system security, availability, system integrity, and confidentiality is periodically reviewed and compared with the defined system security, availability, system integrity, and confidentiality policies.

CC6.2
CC4.1
J.1.2 47 (B) IS-25 DS 4.9 DSS04.07 312.8 and
312.10
BOSS > Operational Risk
Management > Key Risk Indicators
shared x Domain 2 6.07.01. (a)

6.07.01. (i)
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8
NIST SP 800-53 R3 IR-4
NIST SP 800-53 R3 IR-4 (1)
NIST SP 800-53 R3 IR-5
NIST SP 800-53 R3 IR-8

1.2.7 1.2.10
45 CFR 164.308 (a)(1)(ii)(D) A.13.2.2 A.16.1.6
Supply Chain
Management,
Transparency and
Accountability
Data Quality and
Integrity
STA-01 Providers shall inspect, account for, and work with their cloud supply-chain partners to correct data quality errors and associated risks. Providers shall design and implement
controls to mitigate and contain data security risks through proper separation of duties, role-based access, and leastprivilege access for all personnel within their supply chain. -- APO10
APO11
DSS05.04
DSS06.03
DSS06.06
SRM > Governance Risk &
Compliance > Vendor Management
provider X Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Supply Chain 6.1.2(b)
Management,
Transparency and
Accountability
Incident Reporting
STA-02 The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals).
-- APO09.03
APO09.04
APO10.04
APO10.05
DSS02.07
ITOS > Service Support -> Incident
Management > Cross Cloud
Incident Response
provider Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)
Supply Chain 6.1.2(a)(2),
Management,
Transparency and
Accountability
Network / Infrastructure
Services
STA-03 Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems components, shall be designed, developed, and
deployed in accordance with mutually agreed-upon service and capacity-level expectations, as well as IT governance and service management policies and procedures.

X X X X X X X X X X X X C2.2.0 (C2.2.0) The system security, availability, system integrity, and confidentiality and related security obligations of users and the entity’s system security, availability, system integrity, and confidentiality and related security commitments to users are communicated to authorized users.

CC2.2
CC2.3
C.2 C.2.6, G.9.9 45 (B)
74 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-31 DS5.10 APO01.03 APO03.01
APO03.02
APO09.03
BAI02.01
BAI02.04
BAI07.05
312.8 and 312.10 ITOS > Service Delivery > Service
Level Management
provider x Domain 2 6.02. (c)

6.03.07. (a)

6.03.07. (b)

6.03.07. (c)

8.2.2 8.2.5
A.6.2.3
A.10.6.2
A.15.1.2
A.13.1.2
Commandment #6
Commandment #7
Commandment #8
Supply Chain
Management,
Transparency and
Accountability
Provider Internal
Assessments
STA-04 The provider shall perform annual internal assessments of conformance to, and effectiveness of, its policies, procedures, and supporting measures and metrics.

X X X X X X X X X X X -- MEA01
MEA02
SRM > Governance Risk &
Compliance > Vendor Management
provider x Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Supply Chain 6.1.2(b)
Management,
Transparency and
Accountability
Supply Chain
Agreements
STA-05 Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutually-agreed upon provisions and/or terms:
• Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business
relationships, physical geographical location of hosted services, and any known regulatory compliance
considerations)
• Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship, and references to detailed supporting and relevant business processes and technical measures
implemented to enable effectively governance, risk
management, assurance and legal, statutory and regulatory compliance obligations by all impacted business relationships • Notification and/or pre-authorization of any changes
controlled by the provider with customer (tenant) impacts • Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business
relationships impacted (i.e., up- and down-stream impacted supply chain)
• Assessment and independent verification of compliance with agreement provisions and/or terms (e.g., industry-acceptable certification, attestation audit
report, or equivalent forms of assurance) without posing an unacceptable business risk of exposure to the organization being assessed
• Expiration of the business relationship and treatment of customer (tenant) data impacted
• Customer (tenant) service-to-service application (API) and X X X X X X X X X X X X S2.2.0
A3.6.0
C3.6.0
(S2.2.0) The availability, confidentiality of data, processing integrity, system security and related security obligations of users and the entity’s availability and related security commitments to users are communicated to authorized users.
(A3.6.0) Procedures exist to restrict physical access to the defined system including, but not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers. (C3.6.0) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies.

CC2.2
CC2.3
CC5.5
C1.4
C1.5
C.2 C.2.4, C.2.6, G.4.1, G.16.3 74 (B)
75 (C+, A+)
45 (B)
75 (C+, A+)
79 (B)
4 (C+, A+)
Schedule 1 (Section 5) 4.1 Accountability, Subs. 4.1.3
LG-02 DS5.11
APO09.03
APO09.05
312.3,
312.8 and
312.10 BOSS > Legal Services > Contracts shared x
Domain 3 6.02. (e)

6.10. (h)

1.2.5 45 CFR 164.308 (a)(4)(ii)(A)
45 CFR 164.308 (b)(1)
45 CFR 164.308 (b)(2)(i)
45 CFR 164.308 (b)(2)(ii)
45 CFR 164.308 (b)(2)(iii)
45 CFR 164.308 (b)(3)
45 CFR 164.308 (b)(4)
45 CFR 164.312(e)(2)(i)
45 CFR 164.312 (c)(1)
45 CFR 164.312(e)(2)(ii)
45 CFR 164.314 (a)(1)(i)
45 CFR 164.314 (a)(1)(ii)(A)
45 CFR 164.314 (a)(2)(i)
45 CFR 164.314 (a)(2)(i)(A)
45 CFR 164.314 (a)(2)(i)(B)
45 CFR 164.314 (a)(2)(i)(C)
45 CFR 164.314 (a)(2)(i)(D)
45 CFR 164.314 (a)(2)(ii)(A)
45 CFR 164.314 (a)(2)(ii)(A)(1)
45 CFR 164.314 (a)(2)(ii)(A)(2)
45 CFR 164.314 (a)(2)(ii)(B)
45 CFR 164.314 (a)(2)(ii)(C)
45 CFR 164.314 (b)(1)
45 CFR 164.314 (b)(2)
45 CFR 164.314 (b)(2)(i)
45 CFR 164.314 (b)(2)(ii)
45 CFR 164.314 (b)(2)(iii)
45 CFR 164.314 (b)(2)(iv)
A.6.2.3
A10.2.1
A.10.8.2
A.11.4.6
A.11.6.1
A.12.3.1
A.12.5.4
A.15.1.2,

8.1* partial,
A.13.2.2,
A.9.4.1
A.10.1.1
ITAR 22
CFR §
120.17
EAR 15
CFR §736.2
(b)
Commandment #1
Commandment #4
Commandment #5
Commandment #6
Commandment #7
Commandment #8
Supply Chain
Management,
Transparency and
Accountability
Supply Chain
Governance Reviews
STA-06 Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain.

X X X X X X X X X X X --
APO10.04
APO10.05
MEA01
SRM > Governance Risk &
Compliance > Vendor Management provider x
Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Supply Chain 6.1.2(b)
Management,
Transparency and
Accountability
Supply Chain Metrics
STA-07 Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream).

Reviews shall performed at least annually and identity nonconformance to established agreements. The reviews should result in actions to address service-level conflicts or inconsistencies resulting from disparate supplier
X X X X X X X X X X X 51 (B) -- APO01.03
APO09.03
APO09.04
APO09.05
APO10.01
APO10.03
APO10.04 ITOS > Service Delivery > Service Level Management - Vendor Management provider x Domain 3 6.02. (c)

6.02. (d)

6.07.01. (k)
Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),

6.1.2(b)

6.1.2 (c)
Supply Chain 6.1.2(c)(1),
Management,
Transparency and
Accountability
Third Party Assessment
STA-08 Providers shall assure reasonable information security across their information supply chain by performing an annual review.

The review shall include all partners/third party-providers upon which their information supply chain depends on.

X X X X X X X X X X X --
APO09.03
MEA01
MEA02
SRM > Governance Risk &
Compliance > Vendor Management provider x
Domain 2 Clause

6.1.1,

6.1.1(e)(2)

6.1.2 6.1.2(a)(1)

6.1.2(a)(2),
Supply Chain 6.1.2(b)
Management,
Transparency and
Accountability
Third Party Audits
STA-09 Third-party service providers shall demonstrate compliance with information security and confidentiality, access control, service definitions, and delivery level agreements included in third-party contracts. Third-party reports, records, and services shall undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements.

X X X X X X X X X X X S2.2.0
C2.2.0
C3.6
Note: third party service providers are addressed under either the carve-out method or the inclusive method as it relates to the assessment of controls.
(S2.2.0) The security obligations of users and the entity’s security commitments to users are communicated to authorized users. (C2.2.0) The system confidentiality and related security obligations of users and the entity’s confidentiality and related security commitments to users are communicated to authorized users before the confidential information is provided. This communication includes, but is not limited to, the following matters: (see sub-criteria on TSPC tab)
(C3.6) The entity has procedures to obtain assurance or representation that the confidentiality policies of third parties to whom information is transferred and upon which the entity relies are in conformity with the entity’s defined system confidentiality and related security policies and that the third party is in compliance with its policies.

CC2.2
CC2.3
C1.4
C1.5
C.2 C.2.4,C.2.6, G.4.1, G.4.2, L.2,
L.4, L.7, L.11
60 (B)
62 (C+, A+)
83 (B)
84 (B)
85 (B)
CO-03 ME 2.6
DS 2.1
DS 2.4
APO01.08
APO10.05
MEA02.01
312.2(a)
and 312.3
(Prohibiti
on on
Disclosur
e)
BOSS > Compliance > Third-Party
Audits shared x
Domain 2, 4 6.02. (b)

6.02. (d)
Article 17(2)
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 CA-3
NIST SP 800-53 R3 SA-9
NIST SP 800-53 R3 SA-9 (1)
NIST SP 800-53 R3 SA-12
NIST SP 800-53 R3 SC-7
NIST SP 800-53 R3 SC-7 (1)
NIST SP 800-53 R3 SC-7 (2)
NIST SP 800-53 R3 SC-7 (3)
NIST SP 800-53 R3 SC-7 (4)
NIST SP 800-53 R3 SC-7 (5)
NIST SP 800-53 R3 SC-7 (7)
NIST SP 800-53 R3 SC-7 (8)
NIST SP 800-53 R3 SC-7 (12)
NIST SP 800-53 R3 SC-7 (13)
NIST SP 800-53 R3 SC-7 (18)

1.2.11 4.2.3

7.2.4 10.2.3

10.2.4 45 CFR 164.308(b)(1)
45 CFR 164.308 (b)(4)
A.6.2.3
A.10.2.1
A.10.2.2
A.10.6.2
A.15.1.2

8.1* partial,

8.1* partial, A.15.2.1
A.13.1.2
Commandment #1
Commandment #2
Commandment #3
Threat and Vulnerability
Management
Anti-Virus / Malicious
Software
TVM-01 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

X X X X X X X X X S3.5.0 (S3.5.0) Procedures exist to protect against infection by computer viruses, malicious codes, and unauthorized software.

CC5.8 G.7 17 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-21 DS5.9
APO01.03
APO13.01
APO13.02
DSS05.01
312.8 and
312.10
SRM > Infrastructure Protection
Services > Anti-Virus shared x
Domain 2 6.03. (f)
Article 17
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SC-5
NIST SP 800-53 R3 SI-3
NIST SP 800-53 R3 SI-3 (1)
NIST SP 800-53 R3 SI-3 (2)
NIST SP 800-53 R3 SI-3 (3)
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 SI-7
NIST SP 800-53 R3 SI-7 (1)
NIST SP 800-53 R3 SI-8

8.2.2 45 CFR 164.308 (a)(5)(ii)(B) A.10.4.1 A.12.2.1 Commandment #4 Commandment #5
Threat and Vulnerability
Management
Vulnerability / Patch
Management
TVM-02 Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g. network vulnerability assessment,
penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing
remediation of identified vulnerabilities shall be used.

Changes shall be managed through a change management
process for all vendor-supplied patches, configuration
changes, or changes to the organization's internally
developed software. Upon request, the provider informs
customer (tenant) of policies and procedures and identfied weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

X X X X X X X X X S3.10.0 (S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.

CC7.1 I.4 G.15.2, I.3 32 (B)
33 (B)
Schedule 1 (Section 5), 4.7 - Safeguards, Subsec. 4.7.3 IS-20 AI6.1
AI3.3
DS5.9 APO01.03
APO13.01
APO13.02
BAI06.01
BAI06.02
BAI06.03
BAI06.04
DSS01.01
DSS01.02
DSS01.03
DSS03.05
DSS05.01
DSS05.03
DSS05.07
312.8 and
312.10
SRM > Threat and Vulnerability
Management > Vulnerability
Management shared x
Domain 2 6.03.02. (a)

6.03.02. (b)

6.03.05. (c)

6.07.01. (o)
Article 17
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-5
NIST SP 800-53 R3 CM-3
NIST SP 800-53 R3 CM-3 (2)
NIST SP 800-53 R3 CM-4
NIST SP 800-53 R3 RA-5
NIST SP 800-53 R3 RA-5 (1)
NIST SP 800-53 R3 RA-5 (2)
NIST SP 800-53 R3 RA-5 (3)
NIST SP 800-53 R3 RA-5 (6)
NIST SP 800-53 R3 RA-5 (9)
NIST SP 800-53 R3 SC-30
NIST SP 800-53 R3 SI-1
NIST SP 800-53 R3 SI-2
NIST SP 800-53 R3 SI-2 (2)
NIST SP 800-53 R3 SI-4
NIST SP 800-53 R3 SI-5

1.2.6 8.2.7
45 CFR 164.308 (a)(1)(i)(ii)(A)
45 CFR 164.308 (a)(1)(i)(ii)(B)
45 CFR 164.308 (a)(5)(i)(ii)(B)
A.12.5.1
A.12.5.2
A.12.6.1

8.1*partial, A.14.2.2,

8.1*partial, A.14.2.3
A.12.6.1
Commandment #4
Commandment #5
Threat and Vulnerbility
Management
Mobile Code
TVM-03 Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or
untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

X X X X X X X X X S3.4.0
S3.10.0
(S3.4.0) Procedures exist to protect against infection by computer viruses, malicious code, and unauthorized software.
(S3.10.0) Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined system security policies to enable authorized access and to prevent unauthorized access.

CC5.6
CC7.1
G.20.12, I.2.5 SA-15
APO01.03
APO13.01
APO13.02
DSS05.01
DSS05.02
DSS05.03
DSS05.04
312.8 and
312.10
SRM > Infrastructure Protection
Services > End Point - White Listing shared x
Domain 10 6.03. (g)
Article 17
A.10.4.2
A.12.2.2
A.12.2.1 Commandment #1
Commandment #2
Commandment #3
Commandment #5
Commandment #11
© Copyright 2014 Cloud Security Alliance - All rights reserved. You may download, store, display on your computer, view, print, and link to the Cloud Security Alliance “Cloud Controls Matrix (CCM) Version

3.0.1” at http://www.cloudsecurityalliance.org subject to the following: (a) the Cloud Controls Matrix v3.0.1 may be used solely for your personal, informational, non-commercial use; (b) the Cloud Controls Matrix v3.0.1 may not be modified or altered in any way; (c) the Cloud Controls Matrix v3.0.1 may not be redistributed; and (d) the trademark, copyright or other notices may not be removed. You may quote portions of the Cloud Controls Matrix v3.0.1 as permitted by the Fair Use provisions of the United States Copyright Act, provided that you attribute the portions to the Cloud Security Alliance Cloud Controls Matrix Version

3.0.1 (2014). If you are interested in obtaining a license to this material for other usages not addresses in the copyright notice, please contact [email protected].

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 290
#15..
- 621 -
Mexico - Federal Law on Protection of Personal Data Held by Private Parties NERC CIP NIST SP800-53 R3 NIST SP800-53 R4 App J NZISM PCI DSS v2.0 PCI DSS v3.0 PA ID PA level
CIP-007-3 - R5.1 SC-2
SC-3
SC-4
SC-5
SC-6
SC-7
SC-8
SC-9
SC-10
SC-11
SC-12
SC-13
SC-14
SC-17
SC-18
SC-20
SC-21
SC-22
SC-23
AR-7 The organization
designs information
systems to support privacy
by automating privacy
controls.

14.5 14.6
PA17
PA31
SGP
BSGP

6.5 6, 6.5
CA-1
CA-2
CA-5
CA-6
AP-1 The organization
determines and documents
the legal authority that
permits the collection, use,
maintenance, and sharing
of personally identifiable

9.2 4.1.1, 4.2, 4.3
CIP-003-3 - R4.2 SI-10
SI-11
SI-2
SI-3
SI-4
SI-6
SI-7
SI-9
AR-7 The organization
designs information
systems to support privacy
by automating privacy
controls.

14.5 14.6
PA25 GP 6.3.1

6.3.2 6.3.1

6.3.2 AC-1
AC-4
SC-1
SC-16
AR-7 The organization
designs information
systems to support privacy
by automating privacy
controls.

16.5 16.8

17.4 PA20
PA25
PA29
GPP
SGP

2.3 3.4.1

4.1 4.1.1

6.1 6.3.2a

6.5c

8.3 10.5.5

11.5 2.3

3.4.1 4.1

4.1.1 6.1

6.3.2a

6.5c, 7.1, 7.2, 7.3, 8.1, 8.2,

8.3, 8.4, 8.5, 8.6, 8.7, 8.8

10.5.5, 10.8

11.5, 11.6
CA-2
CA-7
PL-6
AR-4 Privacy Auditing and
Monitoring. To promote
accountability,
organizations identify and
address gaps in privacy
compliance, management,
operational, and technical
controls by conducting
regular assessments

5.1, 5.3, 5.4 PA15 SGP 2.1.2.b
Chapter VI, Section 1
Article 39, I. and VIII.

Chapter 8
Article 59
CIP-003-3 - R1.3 - R4.3
CIP-004-3 R4 - R4.2
CIP-005-3a - R1 - R1.1 - R1.2
CA-1
CA-2
CA-6
RA-5
AR-4. Privacy Auditing and
Monitoring. These
assessments can be selfassessments or thirdparty
audits that result in reports
on compliance gaps
identified in programs,
projects, and information
systems.

6.1 PA18 GP 11.2

11.3 6.6

12.1.2.b

11.2 11.3

6.3.2, 6.6

11.2.1, 11.2.2, 11.2.3,

11.3.1, 11.3.2, 12.1.2.b,

12.8.4 AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-7
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
RA-2
SA-1
SA-6
SC-1
SC-13
SI-1

1.2 2.2

3.3 5.2

3.1.1 3.1

3.1 CP-1
CP-2
CP-3
CP-4
CP-6
CP-7
CP-8
CP-9
CP-10
PE-17
UL-2 INFORMATION

SHARING WITH THIRD
PARTIES - a. Shares
personally identifiable
information (PII) externally,
only for the authorized
purposes identified in the
Privacy Act and/or
described in its notice(s)
or for a purpose that is
compatible with those
purposes; b. Where
appropriate, enters into
Memoranda of
Understanding,
Memoranda of Agreement,
Letters of Intent, Computer
Matching Agreements, or
similar agreements, with
third parties that
specifically describe the
PII covered and specifically
enumerate the purposes
for which the PII may be
used; c. Monitors, audits,
and trains its staff on the

6.4 12.9.1

12.9.3 12.9.4

12.9.6 12.9.1

12.9.3 12.9.4

12.9.6 CP-2
CP-3
CP-4

4.4 5.2(time limit)

6.3(whenever change occurs)
PA15 SGP 12.9.2 12.9.2, 12.10.2
PE-1
PE-4
PE-13

10.1 10.2

10.3 10.4

10.5 10.6
PA15 SGP 4.1, 4.1.1, 9.1, 9.2
CIP-005-3a - R1.3
CIP-007-3 - R9
CP-9
CP-10
SA-5
SA-10
SA-11

10.5 13.5

17.1 12.1

12.2 12.3

12.4 1.1.2, 1.1.3, 2.2, 12.3

12.6 CIP-004-3 R3.2 PE-1
PE-13
PE-14
PE-15
PE-18

8.1 8.4
PA15 SGP 3.5.2, 3.6.3, 3.7,

5.1, 5.2, 5.3,

6.1, 6.2,

7.1, 7.2,

9.1, 9.2, 9.3, 9.4, 9.5, 9.6,

9.7, 9.8, 9.9,

12.2 PE-1
PE-5
PE-14
PE-15
PE-18

8.1 PA15 SGP 9.1.3

9.5 9.6

9.9 9.9.1

9.1.3 9.5

9.6 9.9

9.9.1, 12.2
CIP-007-3 - R6.1 - R6.2 - R6.3 -
R6.4
MA-2
MA-3
MA-4
MA-5
MA-6

3.3 12.1

12.5 14.5 (software)
PA8
PA15
BSGP
SGP

10.8, 11.6
CP-8
PE-1
PE-9
PE-10
PE-11
PE-12
PE-13
PE-14

8.1 8.2

8.3 8.4
PA15 SGP
CIP-007-3 - R8 - R8.1 - R8.2 -
R8.3
RA-3 6.4 PA8
PA15
BSGP
SGP
CM-2
CM-3
CM-4
CM-5
CM-6
CM-9
MA-4
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-12

12.1 12.2

12.3 12.4

4.3, 10.8,

11.1.2,

12.1 12.2

12.3 12.4

12.5, 12.5.3,

12.6, 12.6.2,

12.10 Chapter II
Article 11, 13
CIP-003-3 - R4.1 CP-2
CP-6
CP-7
CP-8
CP-9
SI-12
AU-11
FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do

6.4 13.1
PA10
PA29
BSGP
SGP

3.1 3.1.1

3.2 9.9.1

9.5 9.6

10.7 3.1

3.1.a

3.2 9.9.1

9.5. 9.5.1

9.6. 9.7, 9.8

10.7, 12.10.1
CA-1
CM-1
CM-9
PL-1
PL-2
SA-1
SA-3
SA-4

12.1 6.3.2 6.3.2, 12.3.4
SA-4
SA-5
SA-8
SA-9
SA-10
SA-11
SA-12
SA-13

2.2 4.1
PA17 SGP 3.6.7

6.4.5.2 7.1.3

8.5.1 9.1

9.1.2 9.2b

9.3.1 10.5.2

11.5 12.3.1

12.3.3 2.1, 2.2.4, 2.3, 2.5

3.3, 3.4, 3.6

4.1, 4.2

6.3.1, 6.3.2, 6.4.2, 6.4.3,

6.4.4, 6.4.5.2

6.7 7.1, 7.1.3, 7.1.4

8.3, 8.5.1, 8.7

9.1 9.1.2

9.2 10.5

11.5 12.3

12.8 CM-1
CM-2
SA-3
SA-4
SA-5
SA-8
SA-10
SA-11
SA-13

12.1 14.1

14.2 1.1.1

6.1 6.4

6.1 6.2

6.3 6.4

6.5 6.6

6.7 CM-1
CM-2
CM-3
CM-5
CM-7
CM-8
CM-9
SA-6
SA-7
SI-1
SI-3
SI-4
SI-7
FTC Fair Information
Principles
Involves both managerial
and technical measures to
protect against loss and
the unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

14.1 1.3.3

2.1, 2.2.2

3.6 4.1

5.1, 5.2, 5.3, 5.4

6.2 7.1

9.1 9.1.1

9.1.2 9.1.3

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3

10.1, 10.2, 10.3, 10.4, 10.5,

10.6, 10.7

11.1, 11.4, 11.5

12.3 CIP-003-3 - R6 CA-1
CA-6
CA-7
CM-2
CM-3
CM-5
CM-6
CM-9
PL-2
PL-5
SI-2
SI-6
SI-7
AR- 4. Privacy Monitoring
and Auditing.

Organizations also: (i)
implement technology to
audit for the security,
appropriate use, and loss
of PII; (ii) perform reviews
to ensure physical security
of documents containing
PII; (iii) assess contractor
compliance with privacy
requirements; and (iv)
ensure that corrective
actions identified as part of
the assessment process
are tracked and monitored
until audit findings are
corrected. The
organization Senior
Agency Official for Privacy
(SAOP)/Chief Privacy
Officer (CPO) coordinates
monitoring and auditing
efforts with information
security officials and

12.1 12.4
PA14 SGP 1.1.1

6.3.2 6.4

6.1 1.1.1

6.3.2 6.4.5
General Provisions, Article 3, V. and VI. CIP-003-3 - R4 - R5 RA-2 AC-4
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII used
in Testing, Training, and
Research.

PA10 SGP 9.7.1

9.10 12.3

3.1 9.6.1, 9.7.1

9.10 12.3
TR-2 SYSTEM OF

RECORDS NOTICES

AND PRIVACY ACT

STATEMENTS

1.1.3 12.3.3
AC-14
AC-21
AC-22
IA-8
AU-10
SC-4
SC-8
SC-9
TR-2 SYSTEM OF

RECORDS NOTICES

AND PRIVACY ACT

STATEMENTS
PA25
PA21
PA5
GP
GP
BSGP

2.1.1 4.1

4.1.1 4.2

2.1.1 3.1

4.1 4.1.1

4.2 Chapter II
Article 8, 9, 11, 12, 14, 18, 19, 20, 21 CIP-003-3 - R4 - R4.1 AC-16 MP-1
MP-3
PE-16
SI-12
SC-9
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII used
in Testing, Training, and
Research. SE-1

INVENTORY OF

PERSONALLY

IDENTIFIABLE

13.1 9.5

9.6 9.7.1

9.7.2 9.10

9.5, 9.5.1

9.6 9.7

9.8 9.9
CIP-003-3 - R6 SA-11
CM-04
DM-1 Minimization of
Personsally Identifidable
Information. DM-2 Data
Retention & Disposal. DM3 Minimization of PII used
in Testing, Training, and
Research.

17.8 6.4.3 6.4.3
Chapter IV
Article 30
CIP-007-3 - R1.1 - R1.2 CA-2
PM-5
PS-2
RA-2
SA-2
AP-1 AUTHORITY TO
COLLECT. AP-2

PURPOSE
SPECIFICATION.

3.4 3.7

12.5.5 12.10.4
CIP-007-3 - R7 - R7.1 - R7.2
R7.3
MP-6
PE-1
DM-2 DATA

RETENTION AND

DISPOSAL

13.4 13.5
PA10
PA39
PA34
PA40
BSGP
SGP
SGP
SGP

3.1.1 9.10

9.10.1 9.10.2

3.1 3.1.1

9.8, 9.8.1, 9.8.2, 3.1

12.3 PA4
PA8
PA37
PA38
BSGP
BSGP
SGP
SGP

9.7.1 9.9

9.9.1 CIP-006-3c R1.2 - R1.3 - R1.4 -
R1.6 - R1.6.1 - R2 - R2.2
PE-2
PE-3
PE-6
PE-7
PE-8
PE-18

8.1 8.2
PA4 BSGP 9.1

9.1.1 9.1.2

9.1.3 9.2

9.1 9.1.1

9.1.2, 9.1.3

9.2, 9.3, 9.4, 9.4.1, 9.4.2,

9.4.3, 9.4.4
IA-3
IA-4
PA22
PA33
GP
SGP
AC-17
MA-1
PE-1
PE-16
PE-17

12.5 19.1
PA4 BSGP 9.8

9.9 9.10

9.6.3 CM-8 12.6 PA4 BSGP 9.9.1

12.3.3 12.3.4

9.8, 9.8.1, 9.8.2

12.3 CIP-006-3c R1.2 - R1.3 - R1.4 -
R2 - R2.2
PE-2
PE-3
PE-4
PE-5
PE-6

4.2 8.1
PA4 BSGP 9.1 9.1

9.1.1 9.1.2

9.2 9.3

9.4 9.4.1

9.4.2 CIP-006-3c R1.2 - R1.3 - R1.4 PE-7 9.4.3
PE-16
PE-18

8.2 8.1
PA4 BSGP 9.1

9.1.1 9.1.3
MA-1
MA-2
PE-16

8.1 8.2

8.3 8.4
PA4 BSGP 9.8

9.9 9.1

9.1.1 9.1.2

9.2 9.3

9.4 Chapter II,
Article 19 CIP-006-3c R1.2 - R1.3 - R1.4 -
R1.6 - R1.6.1 - R2 - R2.2
PE-2
PE-3
PE-6
PE-18

8.1 8.2
PA4
PA13
PA24
BSGP
SGP P

9.1 9.1

9.1.1 9.1.2

9.2 9.3

9.4 9.4.1

9.4.2 9.4.3

9.4.4 PA36

3.5, 7.1.3

8.1 8.1.1

8.2.2 8.5

8.5.1 SC-12
SC-13
SC-17
SC-28

16.2 PA36 3.4.1

3.5 3.5.1

3.5.2 3.6

3.6.1 3.6.2

3.6.3 3.6.4

3.6.5 3.6.6

3.6.7 3.6.8

3.4.1 3.5

3.5.1 3.5.2

3.6 3.6.1

3.6.2 3.6.3

3.6.4 3.6.5

3.6.6 3.6.7

3.6.8,

4.1 ODCA UM: PA R2.0
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 291
#15..
- 622 -
CIP-003-3 - R4.2 AC-18
IA-3
IA-7
SC-7
SC-8
SC-9
SC-13
SC-16
SC-23
SI-8

16.1 PA25 GP 2.1.1

3.4 3.4.1

4.1 4.1.1

4.2 2.1.1

2.3 3.3

3.4 3.4.1

4.1 4.1.1

4.2 4.3

6.5.3 6.5.4

8.2.1 3.5.2, 3.5.3

3.6.1, 3.6.3
Chapter II, Article 19 and Chapter VI, Section I, Article 39 CM-2 SA-2
SA-4
AR-1 Governance and
Privacy Program. TR-1
PRIVACY NOTICE. TR-3

DISSEMINATION OF

PRIVACY PROGRAM

INFORMATION

4.4 5.1

1.1 1.1.1

1.1.2 1.1.3

1.1.4 1.1.5

1.1.6 2.2

2.2.1 2.2.2

2.2.3 2.2.4

1.1 1.1.1

1.1.2 1.1.3

1.1.4 1.1.5

1.1.6 2.2

2.2.1 2.2.2

2.2.3 2.2.4
CA-3
RA-2
RA-3
MP-8
PM-9
SI-12
AR-2 Privacy Impact and
Risk Assessment

3.3 4.3

8.4 PA10
PA18
BSGP
GP

12.1 12.1.2

12.2 AT-2
AT-3
CA-1
CA-5
CA-6
CA-7
PM-10
AR-1 Governance and
Privacy Program

3.2 12.6.1

12.6.2 12.6, 7.3, 8.8, 9.10
Chapter II, Article 19 CIP-001-1a - R1 - R2
CIP-003-3 - R1 - R1.1 - R4
CIP-006-3c R1
PM-1
PM-2
PM-3
PM-4
PM-5
PM-6
PM-7
PM-8
PM-9
PM-10
PM-11
AR-1 Governance and
Privacy Program

4.1 PA8 BSGP 12.1

12.2 12.1

12.2 Chapter VI, Section I, Article 39 CIP-003-3 - R1 - R1.1 CM-1 PM-1
PM-11

4.1 12.5 12.4
Chapter VI, Section I, Article 39 CIP-003-3 - R1 -R1.1 - R1.2 - R2 - R2.1 - R2.2 - R2.3
AC-1
AT-1
AU-1
CA-1
CM-1
IA-1
IR-1
MA-1
MP-1
MP-1
PE-1
PL-1
PS-1
SA-1
SC-1
SI-1

4.2 4.3

4.4 4.5
PA30 BSGP 12.1

12.2 7.3, 8.8, 9.10, 12.1

12.2 Chapter X, Article 64 PL-4
PS-1
PS-8
CIP-009-3 - R2 CP-2
RA-2
RA-3
AR-2 Privacy Impact and
Risk Assessment

4.3 12.1.3 12.2
CIP-003-3 - R3.2 - R3.3 - R1.3
R3 - R3.1 - R3.2 - R3.3
AC-1
AT-1
AU-1
CA-1
CM-1
CP-1
IA-1
IA-5
IR-1
MA-1
MP-1
PE-1
PL-1
PM-1
PS-1
RA-1
SA-1
SC-1
SI-1

4.1 6.1

12.1.3 12.1.1
CIP-002-3 - R1.1 - R1.2
CIP-005-3a - R1 - R1.2
CIP-009-3 - R.1.1
PL-5
RA-2
RA-3

1.1 3.3

5.1 5.2

5.3 5.4

7.1 12.2

17.7 18.1

18.3 PA2
PA15
BSGP
SGP

12.1.2 12.2
Chapter II
Article 19
CIP-009-3 - R4 AC-4
CA-2
CA-6
PM-9
RA-1
AR-2 Privacy Impact and
Risk Assessment

3.2 (responsibility)

3.3 3.4

4.1 4.3

5.2 (residual Risk)

12.1.2 12.2
PS-4 2.2 9.3
CIP-004-3 - R2.2 PS-2
PS-3

9.29 PA27 BSGP 12.7

12.8.3 12.7

12.8.3 PL-4
PS-6
PS-7

9.2 PA27 BSGP 12.4

12.8.2 PS-4
PS-5
PA27 BSGP
CIP-007-3 - R7.1 AC-17
AC-18
AC-19
MP-2
MP-4
MP-6

19.1 19.2

19.3 PA33
PA34
SGP
SGP

9.7 9.7.2

9.8 9.9

11.1 12.3

11.1 12.3
PL-4
PS-6
SA-9
DI-2 DATA INTEGRITY

AND DATA INTEGRITY
BOARD
a. Documents processes
to ensure the integrity of
PA7 BSGP 12.8.2

12.8.3 12.8.4
AT-3
PL-4
PM-10
PS-1
PS-6
PS-7
AR-1 GOVERNANCE

AND PRIVACY

PROGRAM
Control: The organization:

Supplemental Guidance:

The development and
implementation of a

2.2 PA9
PA24
BSGP 12.8.5
AC-8
AC-20
PL-4

2.2 5.2

4.2 12.3.5 12.3
Chapter VI, Section I, Article 39 and Chapyer VI, Section II, Article 41 CIP-004-3 - R1 - R2 - R2.1 AT-1 AT-2
AT-3
AT-4
AR-5 PRIVACY

AWARENESS AND

TRAINING
Control: The organization:
a. Develops, implements,
and updates a
comprehensive training
and awareness strategy
aimed at ensuring that

9.1 PA28 BSGP 12.6

12.6.1 12.6.2

12.6 Chapter VI, Section I, Article 39 and Chapyer VI, Section II, Article 41 AT-2 AT-3
AT-4
PL-4
UL-1 INTERNAL USE
Control: The organization
uses personally identifiable
information (PII) internally
only for the authorized
purpose(s) identified in the
Privacy Act and/or in public

9.1 8.5.7

12.6.1 12.4
AC-11
MP-2
MP-3
MP-4

8.1 8.1.8
CIP-003-3 - R5.2 AU-9
AU-11
AU-14

15.4 10.5.5 10.5

7.1.2 7.1.4

7.2 CIP-007-3 - R5.1 - R5.1.2 AC-1 8.1
IA-1

15.1 15.2

3.5.1 8.5.1

12.5.4 3.5.1, 7.0

8.0 12.5.4
CIP-007-3 - R2 CM-7
MA-3
MA-4
MA-5

15.4 9.1.2 1.2.2

7.1 7.1.2

7.1.3 7.2

7.2.3 9.1.2

9.1.3 7.3

8.8 9.10
CIP-007-3 R5.1.1 AC-1
AC-2
AC-5
AC-6
AU-1
AU-6
SI-1
SI-4

3.0 3.1

3.2 3.3

3.4 3.5
PA24P 6.4.2 6.4.2, 7.3

8.8 9.10
CM-5
CM-6

9.4 14.1

14.2 19.1

6.4.1 6.4.2

6.4.1 6.4.2, 7.1

7.1.1 7.1.2

7.1.3 CA-3 7.1.4
MA-4
RA-3
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of passwords;
and the storage of data on

2.2 4.3

12.8.1 12.8.2

12.8.3 12.8.4

12.8 12.2
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those

3.2 9.2

15.2 7.1

7.1.1 7.1.2

7.1.3 7.1.4

7.2 CIP-003-3 - R5.1.1 - R5.3
CIP-004-3 R2.3
CIP-007-3 R5.1 - R5.1.2
AC-3
AC-5
AC-6
IA-2
IA-4
IA-5
IA-8
MA-5
PS-6
SA-7
SI-9
AP-1 The organization
determines and documents
the legal authority that
permits the collection, use,
maintenance, and sharing
of personally identifiable
information (PII), either
generally or in support of a
specific program or
information system need.

9.2 15.2
PA24 GP 7.1

7.1.1 7.1.2

7.1.3 7.2.1

7.2.2 8.5.1

12.5.4 7.1

7.1.1 7.1.2

7.1.3 7.1.4

12.5.4 CIP-004-3 R2.2.2
CIP-007-3 - R5 - R.1.3
AC-2
AU-6
PM-10
PS-6
PS-7

9.2 8.1.4
CIP-004-3 R2.2.3
CIP-007-3 - R5.1.3 -R5.2.1 -
R5.2.3
AC-2
PS-4
PS-5
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures

9.2 8.5.4

8.5.5 8.1.3

8.1.4 8.1.5, 12.5.4
CIP-004-3 R2.2.3
CIP-007-3 - R5.2 - R5.3.1 -
R5.3.2 - R5.3.3
AC-1
AC-2
AC-3
AC-11
AU-2
AU-11
IA-1
IA-2
IA-5
IA-6
IA-8
SC-10
"FTC Fair Information
Principles
Integrity/Security
Security involves both
managerial and technical
measures to protect
against loss and the
unauthorized access,
destruction, use, or
disclosure of the data.(49)
Managerial measures
include internal
organizational measures
that limit access to data
and ensure that those
individuals with access do
not utilize the data for
unauthorized purposes.

Technical security
measures to prevent
unauthorized access
include encryption in the
transmission and storage
of data; limits on access
through use of passwords;

15.1 15.2
PA9
PA6
PA24
PA22
BSGP
BSGP P
GP

8.1 8.2,

8.3 8.4

8.5 10.1,

12.2,

12.3.8 8.0

10.1,

12.3 CIP-007-3 - R2.1 - R2.2 - R2.3 AC-5
AC-6
CM-7
SC-3
SC-19

12.2 14.2

7.1.2 5.0

7.1 7.1.2

7.2 CIP-007-3 - R6.5 AU-1
AU-2
AU-3
AU-4
AU-5
AU-6
AU-7
AU-9
AU-11
AU-12
AU-14
SI-4

17.6 PA11
PA12
PA13
PA24
BSGP
SGP
SGP P

10.1 10.2

10.3 10.5

10.6 10.7

11.4 12.5.2

12.9.5 10.1

10.2 10.3

10.4 10.5

10.6 10.7, 10.8

11.4, 11.5, 11.6

12.5.2 PA35 GP 10.5.5, 12.10.5
AU-1
AU-8

10.4 10.4
SA-4 3.3 PA16 SGP
PA36 6.1
CIP-004-3 R2.2.4 SC-7 17.1

17.2 PA3
PA5
PA16
PA19
PA18
BSGP
BSGP
SGP
GP
SGP

1.1 1.1.2

1.1.3 1.1.5

1.1.6 1.2

1.2.1 2.2.2

2.2.3 1.1

1.1.2 1.1.3

1.1.5 1.1.6

1.2 1.2.1

1.2.2 1.2.3

1.3 2.2.2

2.2.3 2.2.4

2.5 4.1

2.1 2.2

2.5 5.1
SC-2 14.5 PA3 BSGP 6.4.1

6.4.2 6.4.1

6.4.2 CIP-004-3 R3 AC-4
SC-2
SC-3
SC-7

17.6 18.1

18.4 PA3
PA5
PA16
PA20
BSGP
BSGP
SGP
GP

1.1 1.2

1.2.1 1.3

1.4 1.1

1.2 1.2.1

1.2.3 1.3

1.4 2.1.1

2.2.3 2.2.4

2.3 State of Utah Bid CH16012
3/22/2016 4:23 PM p. 292
#15..
- 623 -

4.1 3.5.1, 3.6.6
CIP-004-3 R3
CIP-007-3 - R6.1
AC-1
AC-18
CM-6
PE-4
SC-3
SC-7

11.1 17.3
PA3
PA6
PA16
PA20
PA25
PA32
PA33
BSGP
BSGP
SGP
GP
P
BSGP
SGP

1.2.3 2.1.1

4.1 4.1.1

11.1 9.1.3

1.2.3 2.1.1

4.1 4.1.1

11.1, 11.1.a, 11.1.b, 11.1.c, 11.1.d, 11.1.1, 11.1.2

9.1.3 4.1

4.1.1 4.3
PA32 BSGP 4.1
PA34 SGP
Chapter VI,
Article 44.

Chatper II,
Article 16, part I
CIP-001-1a R3 - R4 AT-5
IR-6
SI-5

3.2 11.1.e

12.5.3 12.9

12.5.3 12.10.1
Chapter II, Article 20 CIP-007-3 - R6.1
CIP-008-3 - R1
IR-1
IR-2
IR-3
IR-4
IR-5
IR-7
IR-8
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE

4.1 4.2

4.6 7.1
PA8
PA11
BSGP 12.9

12.9.1 12.9.2

12.9.3 12.9.4

12.9.5 12.9.6

12.1 Chapter II, Article 20 CIP-003-3 - R4.1
CIP-004-3 R3.3
IR-2
IR-6
IR-7
SI-4
SI-5
IP-4 COMPLAINT
MANAGEMENT. SE-2

PRIVACY INCIDENT

RESPONSE

7.2 PA8 BSGP 12.5.2

12.5.3 12.10.1
CIP-004-3 R3.3 AU-6
AU-7
AU-9
AU-11
IR-5
IR-7
IR-8

7.3 PA11 BSGP
CIP-008-3 - R1.1 IR-4
IR-5
IR-8

7.2 7.3
PA11 BSGP 12.9.6
SC-20
SC-21
SC-22
SC-23
SC-24

17.1 PA3
PA8
PA16
BSGP
BSGP
SGP

12.1.1 Chapter II
Article 14.

CA-3
MP-5
PS-7
SA-6
SA-7
SA-9

5.2 2.2

2.4 12.8.2

12.8.4 Chapter II
Article 14, 21
Chapter III
Article 25
Chapter V
Article 36
CA-3
SA-9
SA-12
SC-7

5.4 2.4

12.8.2 12.8.3

12.8.4 Appendix A

2.4 12.8.2

12.8.3 12.8.4
Appendix A
CIP-007-3 - R4 - R4.1 - R4.2 SA-7
SC-5
SI-3
SI-5
SI-7
SI-8

14.1 17.6 PA1 BSGP

5.1 5.1.1

5.2 1.4, 5.0
CIP-004-3 R4 - 4.1 - 4.2
CIP-005-3a - R1 - R1.1
CIP-007-3 - R3 - R3.1 - R8.4
CM-3
CM-4
CP-10
RA-5
SA-7
SI-1
SI-2
SI-5

12.4 14.1
PA2
PA8 BSGP

2.2 6.1

6.2 6.3.2

6.4.5 6.5

6.6 11.2

11.2.1 11.2.2

11.2.3 2.2

6.1 6.2

6.3.2 6.4.5

6.5 6.6

11.2 11.2.1

11.2.2 11.2.3
SC-18
3 3.1

3.2 3.3

3.4 3.5
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 293
#15..
- 624 -
DRAFT: This document is intended to be a draft and should not be returned to the Division of Purchasing. Please return this document to the evaluation committee This document is not subject to GRAMA pursuant to Utah Administrative Code R33-7-702(2).

Score will be assigned as follows:
1 = Poor, fails to address the requirements in the RFP
2 = Fair, addresses the requirements in the RFP unsatisfactorily 3 = Good, addresses all requirements in the RFP satisfactorily 4 = Very Good, addresses all requirements in the RFP and may exceed some 5 = Superior, addresses all requirements in the RFP and exceeds them RFP
Section
Evaluation
(Pass/Fail)
1 5.1
2 5.2
3 5.3
4 5.4
5 5.5
6 Recertification 5.8
7 Business Profile 6.1
8 6.2
9 6.3
10 7.1
11 9.1
RFP
Section
Evaluator
Score (1-5)
Criteria
Weight
% of Tech
Criteria
Points
Possible
Points
Earned
Minimum
Required
6 1 6.1 5 1.9% 25.0 0.0
2 6.2 5 1.9% 25.0 0.0
3 6.4 5 1.9% 25.0 0.0
4 6.5 5 1.9% 25.0 0.0
5 6.6 5 1.9% 25.0 0.0
6 6.7 5 1.9% 25.0 0.0
7 1 7.1 5 1.9% 25.0 0.0
8 1 8.1 10 3.8% 50.0 0.0
2 8.2 10 3.8% 50.0 0.0
3 8.3 10 3.8% 50.0 0.0
4 8.4 10 3.8% 50.0 0.0
5 8.5 10 3.8% 50.0 0.0
6 8.6 10 3.8% 50.0 0.0
7 8.7 10 3.8% 50.0 0.0
8 8.8 10 3.8% 50.0 0.0
9 8.9 10 3.8% 50.0 0.0
10 8.10. 10 3.8% 50.0 0.0
11 8.11 10 3.8% 50.0 0.0
12 8.12 10 3.8% 50.0 0.0
13 8.13 10 3.8% 50.0 0.0
14 8.14 10 3.8% 50.0 0.0
15 Back up and DisaSter Plan 8.15 10 3.8% 50.0 0.0
16 Solution Administration 8.16 10 3.8% 50.0 0.0
17 Hosting and Provisioning 8.17 10 3.8% 50.0 0.0
18 Trial and Testing Periods 8.18 10 3.8% 50.0 0.0
19 Integration and Customization 8.19 10 3.8% 50.0 0.0
20 8.20. 10 3.8% 50.0 0.0
21 8.21 10 3.8% 50.0 0.0
Contract Manager
Best Practices
Scope of Experience
General Information
Billing and Pricing Practices
Serivce of Data Recovery
Data Protection
Performance Measures and Reporting
Service Provisioning
Marketing Plan
Scope and Variety of Cloud Solutions
Signature Page
Cost Proposal Submitted
Cover Letter
Acknowledgement of Amendments
Scoreable Technical Criteria
Financials
Contract Manager
Value-Added Services
TITLE OF PROJECT (to be inserted by the Division of Purchasing)

RFP EVALUATION SCORESHEET
Firm Name:

Evaluator:

Date:

Minimum Mandatory Requirements
SOLICITATION # (to be inserted by the Division of Purchasing ) Scope of Experience
Working with Purchasing Entities
Customer Service
Security of Information
Technical Requirements
Subcontractors

ORGANIZATION AND STAFFING
Data Disposal
Cloud Security Alliance Questionnaires
Migration and Redeployment Plan

TECHNICAL REQUIREMENTS
Executive Summary
General Requirements

BUSINESS INFORMATION
Business Profile
Service Level Agreements
Privacy and Security
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 294
#15..
- 625 -
22 8.22 10 3.8% 50.0 0.0
23 Alignment of Cloud Computing 8.24 10 3.8% 50.0 0.0
100.0% 1325.0 0.0 0.0
RFP
Section
Min
Percent
Min Points
Required
Points
Earned
Percent
Earned
Evaluation

4.3.2 70% 927.5 0.0 0.0%
RFP
Section
Low Cost
Option
Offered
Cost
Percent of
Total
Points
Possible Points Earned

4.3.3 10% 147.2 0.0
Percent of
Total
Points
Possible
Points
Earned
90% 1,325.0 0.0
10% 147.2 0.0
100% 1,472.2 0.0
Cost
Total Evaluation Points
Total Cost Evaluation Points
Total Technical Evaluation Points
Total Evaluation Points
* Purchasing will use the following cost formula: The points assigned to each offerors cost proposal will be based on the lowest proposal price.

The offeror with the lowest Proposed Price will receive 100% of the price points. All other offerors will receive a portion of the total cost points based on what percentage higher their Proposed Price is than the Lowest Proposed Price. An offeror whose Proposed Price is more than double (200%) the Lowest Proposed Price will receive no points. The formula to compute the points is: Cost Points x (2- Proposed Price/Lowest Proposed Price).

Cost
Required Technical Point Threshold
Supporting Infrastructure
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 295
#15..
- 626 -
ACKNOWLEDGEMENT OF AMENDMENTS TO RFP (SOLICITATION CH16012) This attachment represents that the Offeror has read, reviewed, and understands the totality of Solicitation CH16012, including the final RFP document posted on February 10, 2016.

By signing below, the Offeror attest to reviewing the documents listed above. ______________________________________________________
Offeror
______________________________________________________
Representative Signature
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 296
#15..
- 627 -
5 Question and Answers for Bid #CH16012 - NASPO ValuePoint Cloud Solutions Overall Bid Questions
Question 1
On page 105 of the RFP it states:

A successful Offeror will have the ability to provide cloud based services through the following deployment methods:
ï‚· Private cloud. The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.
ï‚· Community cloud. The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises.
ï‚· Public cloud. The cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organization, or some combination of them. It exists on the premises of the cloud provider. ï‚· Hybrid cloud. The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds) Does a vendor have to be able to provide all of these deployment methods-ie-private, hybrid etc. in order to respond to this RFP? Can we only respond to one type of deployment method? (Submitted: Dec 21, 2015 12:46:45 PM MST)
Answer
- An offeror can provide a response to all of the deployment methods or to one type of deployment method. (Answered: Jan 12, 2016 3:01:39 PM MST)
Question 2
Section 5.6.16 in the main RFP document references Attachment H. However, Attachment H was not provided in the bid documents. Can the State provide Attachment H? (Submitted: Dec 22, 2015 1:10:07 PM MST) Answer
- Solicitation CH16012 has been revised to include Attachment H. (Answered: Dec 22, 2015 4:00:29 PM MST) Question 3
Is it the intent of the State to exclude small businesses from this bid? The minimum D&B rating requirement is extremely exclusionary to small businesses and we would suggest that small businesses will offer the State the best opportunity for innovation in the fast moving cloud market. (Submitted: Dec 31, 2015 11:39:18 AM MST) Answer
- The participating states want some assurance that a vendor is financially stable and able to complete IT projects of this nature. States are putting significant amounts of tax payer dollars into a contractor to provide a solution. If a small business would like to participate on this effort and cannot qualify on their own, they may want to consider partnering with a larger firm in order to qualify. (Answered: Jan 13, 2016 12:28:55 PM MST) Question 4
Attachment B: Cloud Security Alliance Questionnaires, pp. 85-97 - there is a spreadsheet-like matrix in 2-point font size that is illegible when increased in size. Please provide the matrix as a separate document in a 10-point font or higher so that its contents may be read and answers to the questions inserted. (Submitted: Jan 4, 2016 3:30:06 PM MST)
Answer
- The Exhibits to Attachment B have been attached as separate documents. (Answered: Jan 5, 2016 1:01:30 PM MST) Question 5
(Attachment A, Section 16: Insurance): Under what circumstances will the state accept â€œClaims Madeâ€ coverage for professional/network security & privacy liability? (Submitted: Jan 5, 2016 12:17:45 PM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 13, 2016 1:30:25 PM MST)
Question 6
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 297
#15..
- 628 -
coverage for professional/network security & privacy liability? ( , )
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 13, 2016 1:30:25 PM MST)
Question 6
(Attachment A, Section 16: Insurance): Can vendors substitute notice from itself for insurer notice if our insurer wonâ€™t agree to the notice requirements? (Submitted: Jan 5, 2016 12:18:22 PM MST) Answer
- Yes. Contractor shall provide notice to a Participating Entity who is a state within five (5) business days after Contractor is first aware of expiration, cancellation or nonrenewal of such policy or is first aware that cancellation is threatened or expiration, nonrenewal or expiration otherwise may occur. (Answered: Jan 12, 2016 2:55:24 PM MST) Question 7
(Attachment A, Section 16: Insurance): Can vendors use a combination of policies to meet the limits requirements they have to satisfy the insurance requirements? (Submitted: Jan 5, 2016 12:18:41 PM MST) Answer
- Yes. Vendors can use an umbrella insurance coverage to meet the insurance requirements. (Answered: Jan 12, 2016 2:55:24 PM MST)
Question 8
RFP, p. 5, #2.5 and Attachment E - can an offeror choose not to agree to a participating state's terms (and not respond to RFQs from that participating state)? (Submitted: Jan 5, 2016 12:19:32 PM MST) Answer
- If an offeror is awarded a Master Agreement, and contract negotiations for the Master Agreement are successful, then the offeror will be free to negotiate with other eligible states to enter into Participating Addendums. An offeror does not need to agree to participating state's terms, but can negotiate the terms in the applicable Participating Addendum. (Answered: Jan 12, 2016 2:45:09 PM MST)
Question 9
RFP, p. 16, #3.16 - Erate participation. Is it possible to participate in the Erate program with NASPO if the Offeror does not have a SPIN but an Offeror's resellers do? (Submitted: Jan 5, 2016 12:19:50 PM MST) Answer
- If that is allowable under E-Rate program. (Answered: Jan 25, 2016 2:23:05 PM MST) Question 10
RFP, p. 25, #6.3 - Financials - is it acceptable to provide a link to the audited financial statements on our investor relations website due to the length of the financial statements document? (Submitted: Jan 5, 2016 12:20:09

PM MST)
Answer
- Yes. A link would be acceptable. (Answered: Jan 5, 2016 1:06:52 PM MST) Question 11
Clarification of ambiguity - RFP, p. 9, #3.4 - exceptions are to be submitted with the proposal response. RFP, p. 12,, #3.12 - exceptions are to be submitted as questions during Q&A. (Submitted: Jan 5, 2016 12:20:52 PM MST) Answer
- Section 3.4 only refers to the exceptions and/or additions to the Master Agreement Terms and Conditions. An offeror can redline the Master Agreement Terms and Conditions if it so chooses. While Section 3.12 refers to remaining part of the RFP document. "Any exceptions to the content of the RFP, excluding the Master Agreement Terms and Conditions contained in Attachment A, including the Exhibits to Attachment A, must be addressed within the Q&A period. The Offeror further acknowledges that it has read the RFP, along with the Exhibits, Attachments, and any attached or referenced documents, including the General Provisions." (Answered: Jan 5, 2016 1:06:16 PM MST)
Question 12
If a cloud service providerâ€™s (CSP) business model it to sell its solutions to end users via resellers, will the State/NASPO allow the CSP to add resellers under them on their contract for fulfillment of their product (i.e. same model Utah uses for the NASPO Data Communications Products and Services contract)? (Submitted: Jan 8, 2016 6:46:13 AM MST)
Answer
- Correct. The same model that is used in the NASPO Data Communication contracts can be used for this contract. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 13
If a cloud service provider can use resellers for fulfillment, are the resellers subject to section 8.2 of the RFP? (Submitted: Jan 8, 2016 6:46:38 AM MST)
Answer
- Yes. Resellers are subject to 8.2. (Answered: Jan 21, 2016 4:24:21 PM MST) Question 14
If providing multiple cloud offers, what specific sections in 8.1.1 must vendors submit for each cloud offer? State of Utah Bid CH16012
3/22/2016 4:23 PM p. 298
#15..
- 629 -
Question 13
If a cloud service provider can use resellers for fulfillment, are the resellers subject to section 8.2 of the RFP? (Submitted: Jan 8, 2016 6:46:38 AM MST)
Answer
- Yes. Resellers are subject to 8.2. (Answered: Jan 21, 2016 4:24:21 PM MST) Question 14
If providing multiple cloud offers, what specific sections in 8.1.1 must vendors submit for each cloud offer? (Submitted: Jan 8, 2016 6:47:11 AM MST)
Answer
- No. If a vendor offers multiple cloud offers then it only needs to provide one proposal. However, the proposal should provide details on the cloud offers it provides. (Answered: Jan 13, 2016 1:30:08 PM MST) Question 15
Is the state only accepting bids from cloud solution providers, or are the willing to accept bids from resellers and other parties? (Submitted: Jan 8, 2016 6:51:16 AM MST) Answer
- The state is willing to accept bids/proposals from all eligible offerors that are determined to be responsive and responsible. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 16
What service model would Unified Communications as a service (UCaSS) fall under? (Submitted: Jan 8, 2016 2:51:56 PM MST)
Answer
- It is the offerors responsibility to identify the service model.

When choosing between equally plausible service model sub-categories, Offerors should consider several factors:
1) Visibility to the Purchasing Entities. The service model sub-categories in the RFP exist to help Purchasing Entities match their requirements with service characteristics. Offerors should select the most intuitive and appropriate service model from the point of view of a Purchasing Entity. 2) Primary Focus of the Service. Services may offer a mix of capabilities that span service models in the strict technical sense. For example, a service may offer both IaaS capabilities for processing and storage with some PaaS capabilities for application deployment, or SaaS capabilities for specific applications. In a service mix situation the Offerors should select the service model that is their primary focus. 3) Purchasing Entity Role. Offerors should consider the operational role of the Purchasing Entityâ€™s primary actual consumer or operator of the service. For example services most often consumed by system managers are likely to fit best as IaaS; services most often consumed by application deployers or developers as PaaS, and services most often consumed by business users as SaaS. 4) Lowest Level of Configurability. Offerors can consider IaaS, PaaS and SaaS as an ascending hierarchy of complexity, and select the model with the lowest level of available Purchasing Entity interaction. As an example, virtual machines are an IaaS service often bundled with a range of operating systems, which are PaaS services.

The Purchasing Entity usually has access to configure the lower level IaaS service, and the overall service should be considered IaaS. In cases where the Purchasing Entity cannot configure the speed, memory, network configuration, or any other aspect of the IaaS component, consider categorizing as a PaaS service. (Answered: Jan 12, 2016 2:55:24 PM MST)
Question 17
To ensure that a vendor submitting a response is authorized to resell a particular cloud service providers offering(s), would the State consider requiring that any dealer, reseller, agent, distributor, etc. submitting a response, include a signed letter of authorization from the cloud service provider certifying their status? (Submitted:

Jan 11, 2016 6:21:06 PM MST)
Answer
- Yes. If a reseller is submitting a proposal then it should provide some confirmation that it is authorized to provide the specific cloud service. A signed letter would be the best method to demonstrate authorization.

The State reserves the right to clarify with any reseller that it is in fact authorized to provide a cloud service. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 18

1. Cloud Solicitation-2.8 states that the solicitation may be re-issued on a biannual basis. Do you mean biennial or biannual? Biannual would be 2x per year, and biennial is every 2 years. (Submitted: Jan 12, 2016 6:09:23

AM MST)
Answer
- Correct. The word in section 2.8 should be biennial. This will be corrected in the final version of the RFP document. (Answered: Jan 12, 2016 3:00:37 PM MST)
Question 19

2. Cloud Solicitation-9. Cost Proposal- states that we must provide a discount from a commercially available price list in paragraph 1, yet in paragraph 2 it states that the discount is to be from a government pricing catalog.

Many vendors do not have government price lists. Please confirm that we can use either commercial or government price lists to determine our discounts. (Submitted: Jan 12, 2016 6:10:05 AM MST) Answer
- If possible offerors should submit a government pricing catalog; however, if an offeror does not have a government pricing catalog then it can use its commercial price lists (AdJ122016 30037 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 299
#15..
- 630 -
Question 19

Many vendors do not have government price lists. Please confirm that we can use either commercial or government price lists to determine our discounts. (Submitted: Jan 12, 2016 6:10:05 AM MST) Answer
- If possible offerors should submit a government pricing catalog; however, if an offeror does not have a government pricing catalog then it can use its commercial price lists. (Answered: Jan 12, 2016 3:00:37 PM MST) Question 20

3. Attachment G-Cost Proposal and Score sheet-Please explain how you will use your cost formula shown in the Score sheet when comparing discounts from list. Would you look at who is giving the highest discount? If so, this may not be an accurate comparison as some price lists have much higher prices for similar services and can therefore provide a higher net discount which may not result in a true bottom line cost savings (Submitted: Jan 12, 2016 6:10:25 AM MST)
Answer
- Offerors that provide a price schedule with a minimum discount from its Cloud Solutions will receive 152.8 points. If an Offeror fails to provide a discount or a price schedule as required by Section 9.1 its proposal will be disqualified. (Answered: Jan 12, 2016 3:00:37 PM MST)
Question 21
Attachment A-5. Assignments/Subcontracts-Would the State Add the Language in italics so that approval/disapproval by the Lead State is timely and reasonable

5. Assignment/Subcontracts: Contractor shall not assign, sell, transfer, or sublet rights, or delegate responsibilities under this Master Agreement, in whole or in part, without the prior written approval of the Lead State , "which consent shall not be unreasonably withheld". (Submitted: Jan 12, 2016 6:13:15 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 22
Attachment A-7 Termination-Please allow language in italics to insure that Contractors have had 30 days written notice to cure prior to termination of the contract for cause.

Termination of the Master Agreement due to Contractor default may be immediate " if Contractor shall have failed to cure any such default within thirty (30) days of written notice thereof ." (Submitted: Jan 12, 2016 6:15:43 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 23
Attachment A 8. Confidentiality, Non-Disclosure and Injunctive Relieve b. Non-Disclosure. Please allow addition of language in italics and delete (industry standard of confidentiality) . Since there is no industry standard, Contractors should be bound to their own reasonable degree of care for confidential information Contractor shall hold Confidential Information in confidence, using at least the "same degree of care it applies to its own confidential information, but in no event less than a reasonable degree of care", and shall not copy, reproduce, sell, assign, license, market, transfer or otherwise dispose of, give, or disclose (Submitted: Jan 12, 2016 6:20:22 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 24
Attachment A, 8. Confidentiality, Non-Disclosure and Injunctive Relieve c. Injunctive Relief. Please delete the word (acknowledges) and add "has been advised"
Contractor (acknowledges) "has been advised" that breach of this section, including disclosure of any Confidential Information, will cause irreparable injury to Purchasing Entity that is inadequately compensable in damages (Submitted: Jan 12, 2016 6:24:25 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 25
Attachment A 10. Defaults and Remedies. Please allow the addition of "by either party" in italics below. Both parties should be held accountable for nonperformance or material breach, as either party's lack of performance or breach would impact the other party's performance
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 300
#15..
- 631 -
Offerorâ€s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 25
Attachment A 10. Defaults and Remedies. Please allow the addition of "by either party" in italics below. Both parties should be held accountable for nonperformance or material breach, as either party's lack of performance or breach would impact the other party's performance.
(1) Nonperformance "by either party" of contractual requirements; or (2) A material breach "by either party" of any term or condition of this Master Agreement; or (Submitted: Jan 12, 2016 6:34:46 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 26
Attachment A-12. Force Majeure. Please insert the language in parenthesis as entities should continue to pay for goods or services that have been delivered prior to the Force Majeure event.

12. Force Majeure : Neither party shall be in default by reason of any failure in performance of this Contract (except for a failure to pay for goods or services delivered prior to the occurrence of a force majeure event) in accordance with reasonable control and without fault or negligence on their part. (Submitted: Jan 12, 2016 6:43:24 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 27
Attachment A. 13. Indemnification, Paragraph B. Please add language in parenthesis as vendors cannot indemnify Intellectual property for other 3rd party manufacturers products if that third party manufacturer does not provide that level of indemnification.

The Contractor shall defend, indemnify and hold harmless NASPO, NASPO ValuePoint, the Lead State, Participating Entities, Purchasing Entities, along with their officers, agents, and employees as well as any person or entity for which they may be liable ("Indemnified Party"), from and against claims, damages or causes of action including reasonable attorneysâ€™ fees and related costs arising out of the claim that the Product or its use, infringes Intellectual Property rights ("Intellectual Property Claim") of another person or entity" if and to the extent that the respective manufacturers of the Product provide such indemnification to end users thereof." (Submitted: Jan 12, 2016 6:45:56 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 28
Attachment A. 16-Insurance-Please allow claims based and allow additional language that if such policies were to be cancelled prior to the expiration of the contract, that tail coverage would be purchased and maintained for at least a three (3) year minimum. Contractor also agrees that it shall be solely responsible for any self-insured retention or deductibles maintained on any of the polices referenced in this section.

Section 1) Please allow Contractors to add that they agree that insurance limiters may be satisfied using any combination of underyling and excess/umbrella policies.

Regarding cancellation, please allow standard cancellation language that provides for the insurance broker to notify Purchasing of any changes in accordance with insurance provisions-not the Vendor. (Submitted: Jan 12, 2016 6:52:21 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 29
Attachment A- 22. Data Access Controls. Please add language in italics as vendors would have to share information without purchasing's express written consent if required to share the information by law. "Unless required by law", Contractor may not share a Purchasing Entityâ€™s Data with its parent corporation, other affiliates, or any other third party without the Purchasing Entityâ€™s express written consent. (Submitted: Jan 12, 2016 6:54:00 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, State of Utah Bid CH16012
3/22/2016 4:23 PM p. 301
#15..
- 632 -
information without purchasings express written consent if required to share the information by law. "Unless required by law", Contractor may not share a Purchasing Entityâ€™s Data with its parent corporation, other affiliates, or any other third party without the Purchasing Entityâ€™s express written consent. (Submitted: Jan 12, 2016 6:54:00 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 30
Attachment A. 25. Purchasing Entity Data Please add language in parenthesis as many corporations utilize third party legal counsel and accounting firms for which they would need to disclose information.

No information regarding Purchasing Entityâ€™s use of the Service may be disclosed, provided, rented or sold to any third party (with the exception of Contractorâ €™s legal counsel and accountants) for any reason unless required by law or regulation or by an order of a court of competent jurisdiction. The obligation shall extend beyond the term of this Master Agreement in perpetuity. (Submitted: Jan 12, 2016 7:00:47 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 31
Attachment A-26. Records and Administration and Audit. a.

Please allow vendors to provide "copies" of our books instead of our actual books, as vendors would need to keep their original files. In addition, please change the right to audit from six (6) years to two (2 ) years as we believe that this is sufficient time and more reasonable. (Submitted: Jan 12, 2016 7:03:12 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 32
Attachment A-26. Records and Administration and Audit. Would you allow the addition of a paragraph e. at the end of the audit section as it clarifies what a vendor may have examined during an audit , the time, costs, etc. e. Any audit or inspection authorized by this Master Agreement shall be limited to copies of records in the possession or control of Contractor in order to determine Contractorâ€™s compliance with the terms and conditions hereunder, and only to the extent such records solely and directly relate to Contractorâ€™s performance under this Master Agreement. The cost of any such audit or inspection shall be at the sole expense of the Lead State, Participating Entity, or Purchasing Entity, and shall be conducted at the Contractor location(s) where such records are maintained. All Contractor information shall be considered confidential. Audits may be conducted no more than once per year, upon reasonable written notice to Contractor, during Contractorâ€™s normal business hours, with minimal business disruption to Contractor. (Submitted: Jan 12, 2016 7:21:42 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 33
Attachment A. 28. System Failure and Damage- Please allow vendors to add language in italics below as efforts need to be defined.

28. System Failure or Damage: In the event of system failure or damage caused by Contractor or its Services, the Contractor agrees to use its "commercially reasonable" best efforts to restore or assist in restoring the system to operational capacity (Submitted: Jan 12, 2016 7:23:00 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 34
Attachment A-31-Warranty Please delete e and f and add the paragraph below as vendors may be utilizing third party software.
" Contractorâ€™s sole liability (and Lead Stateâ€™s, Purchasing Entityâ€™s and Participating Entityâ€™s exclusive remedy) for any warranty claim shall be for Contractor to re-perform the deficient Services, or, if Contractor fails to remedy such deficiency within thirty (30) days of notice of a claim, to void the invoice for the deficient Services. Contractor shall have no obligation with respect to a warranty claim (i) if notified of such claim more than thirty (30) days after the Services in question were first performed or (ii) if the claim is the result of thirdparty hardware or software failures, or the actions of Lead State, Purchasing Entity or Participating Entity, or a third State of Utah Bid CH16012
3/22/2016 4:23 PM p. 302
#15..
- 633 -
party software.
" Contractorâ€™s sole liability (and Lead Stateâ€™s, Purchasing Entityâ€™s and Participating Entityâ€™s exclusive remedy) for any warranty claim shall be for Contractor to re-perform the deficient Services, or, if Contractor fails to remedy such deficiency within thirty (30) days of notice of a claim, to void the invoice for the deficient Services. Contractor shall have no obligation with respect to a warranty claim (i) if notified of such claim more than thirty (30) days after the Services in question were first performed or (ii) if the claim is the result of thirdparty hardware or software failures, or the actions of Lead State, Purchasing Entity or Participating Entity, or a third party.
(b) THIS SECTION 31 SETS FORTH THE ONLY WARRANTIES MADE BY CONTRACTOR. CONTRACTOR

HEREBY DISCLAIMS ALL OTHER OTHER WARRANTIES, CONDITIONS OR UNDERTAKINGS, EXPRESS OR

IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, BUT NOT LIMITED TO, THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. ALL SOFTWARE

AND HARDWARE PROVIDED OR INSTALLED BY CONTRACTOR ARE SUBJECT EXCLUSIVELY TO THE RESPECTIVE MANUFACTURERS WARRANTY. " (Submitted: Jan 12, 2016 7:25:05 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 35
Attachment A-Terms and Conditions 43-Entire Agreement. Please allow deletion of language in parenthesis below as suppliers utilizing third party software cannot alter the terms and conditions of the software.

This Master Agreement, along with any attachment, contains the entire understanding of the parties hereto with respect to the Master Agreement unless a term is modified in a Participating Addendum with a Participating Entity. (Delete-No click-through, or other end user terms and conditions or agreements required by the Contractor (â€œAdditional Termsâ€ ) provided with any Services hereunder shall be binding on Participating Entities or Purchasing Entities, even if use of such Services requires an affirmative â€œacceptanceâ€ of those Additional Terms before access is permitted.) (Submitted: Jan 12, 2016 7:35:06 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 36
Attachment A-43. Entire agreement-Please allow the additional paragraph to this section in italics below as this defines the liability of the Contractor.
" ADD- LIMITATION OF LIABILITY. (A) CONTRACTOR SHALL NOT BE LIABLE TO THE LEAD STATE,

PURCHASING ENTITY OR PARTICIPATING ENTITY FOR ANY INDIRECT, INCIDENTAL, SPECIAL OR

CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR INTERRUPTION OF

SERVICES, LOSS OF BUSINESS, LOSS OF PROFITS, LOSS OF REVENUE, LOSS OF DATA, OR LOSS OR

INCREASED EXPENSE OF USE), WHETHER IN AN ACTION IN CONTRACT, WARRANTY, TORT (INCLUDING,

WITHOUT LIMITATION, NEGLIGENCE), OR STRICT LIABILITY, EVEN IF CONTRACTOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LIABILITIES. CONTRACTOR SHALL NOT BE RESPONSIBLE FOR PROBLEMS THAT OCCUR AS A RESULT OF THE USE OF ANY THIRD-PARTY SOFTWARE OR HARDWARE. (B) EXCEPT FOR GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, CONTRACTORâ€™S TOTAL LIABILITY TO THE LEAD

STATE, PURCHASING ENTITY AND PARTICIPATING ENTITY ARISING OUT OF SERVICES PERFORMED

UNDER THIS MASTER AGREEMENT, REGARDLESS OF THE LEGAL THEORY UPON WHICH SUCH LIABILITY

MAY BE BASED, SHALL NOT EXCEED IN THE AGGREGATE THE TOTAL PAYMENTS MADE BY LEAD STATE,

PURCHASING ENTITY OR PARTICIPATING ENTITY TO CONTRACTOR FOR THE SERVICES IN QUESTION IN THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE FIRST OCCURRENCE OF THE EVENT GIVING RISE TO SUCH LIABILITY." (Submitted: Jan 12, 2016 7:36:51 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 1:57:23 PM MST)
Question 37
Exhibit 1 (Saas) 7. Termination and Suspension of Service- Please clarify that "purchasing entity" should be capitalized in the section. (Submitted: Jan 12, 2016 8:51:57 AM MST) Answer
- Correct the purchasing entity should be capitalized in this section. (Answered: Jan 12, 2016 2:26:19 PM MST) Question 38
Exhibit 1 (SaaS) 18. Right to Remove Individuals-Please add language in quotation marks and delete language in parenthesis. Reasonable judgement and reasoning should be used in a request to remove an individual from a project, and any removal should be subject to applicable law.

18. Right to Remove Individuals: "Add-Subject to Applicable Law the" (Delete-The ) Purchasing Entity shall have the right at any time to (delete require) "add- request" that the Contractor remove from interaction with Purchasing Entity any Contractor representative who the Purchasing Entity "add-reasonably" believes is detrimental to its working relationship with the Contractor. (Submitted: Jan 12, 2016 8:55:55 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 39
Exhibit 1, (SaaS) 20. Compliance with Accessibility Standards-Please add language in quotation marks as most accessibility standards would apply to the equipment being utilized such as the computer and not the software.

The Contractor shall comply, with and adhere to Accessibility Standards of Section 508 Amendment to the Rehabilitation Act of 1973, or any other state laws or administrative regulations identified by the Participating Entity" Add- if they are applicable to the software or material provided. " (Submitted: Jan 12, 2016 8:57:41 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 40
Exhibit 1 (SaaS) 23. Subscription Services-Please add language in quotation marks. The Click T&C's of software should govern. Vendors utilizing third party software do not have the right to waive click T&C's. (i) access and use the Service for its business purposes; (ii) for SaaS, use underlying software as embodied or used in the Service; and (iii) view, copy, upload and download (where applicable), and use Contractorâ€™s documentation. No Contractor terms, including standard click through license or website terms or use of privacy policy, shall apply to Purchasing Entities unless such terms are included in this Master Agreement. "AddSubscription terms are limited and governed by the terms of the manufacturerâ€™s software license as provide in the RFP response. " (Submitted: Jan 12, 2016 8:59:51 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 41
Exhibit 2-(PaaS) 5.c. Breach Responsibilities -Please add language in quotation marks and delete language in parenthesis. Costs should be limited to that which is reasonable to move than just the Purchasing Entity. c. Unless otherwise stipulated, if a Data Breach is a direct result of Contractorâ€™s breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release (Delete- as reasonably determined by the Purchasing Entity) the Contractor shall bear the "add-reasonable" costs associated with (1) the investigation and resolution of the data breach; (Submitted: Jan 12, 2016 9:02:20 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 42
Exhibit 2 (PaaS) 19. Compliance with Accessibility Standards-Please add language in quotation marks as most accessibility standards would apply to the equipment being utilized, not the software.

No Contractor terms, including standard click through license or website terms or use of privacy policy, shall apply to Purchasing Entities unless such terms are included in this Master Agreement . "Add-Subscription terms are limited and governed by the terms of the manufacturerâ€™s software license as provide in the RFP response. " (Submitted: Jan 12, 2016 9:07:38 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 44
Exhibit 1 (Saas) and Exhibit 3 (IaaS) 4. Security Incident or Data Breach Notification b and c.

We believe that this should say "unreasonable" instead of "reasonable". Please confirm and correct. b. Security Incident Reporting Requirements: The Contractor shall report a security incident to the Purchasing Entity identified contact immediately as soon as possible or promptly without out "Add-un"reasonable delay, or as defined in the SLA. (Submitted: Jan 12, 2016 9:10:46 AM MST) Answer
- Correct. The should be "unreasonable delay". It will be changed in the final RFP document. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 45
Exhibit 1 (SaaS) and 3 (IaaS) 5. c. Breach Responsibilities-Please delete language in parenthesis and add language in quotation marks. Cost should be limited to that which is reasonable to more than just the Purchasing Entity.
c. Unless otherwise stipulated, if a Data Breach is a direct result of Contractorâ€™s breach of its contractual obligation to encrypt Personal Data or otherwise prevent its (Delete- release as reasonably determined by the Purchasing Entity) the Contractor shall bear the "Add-reasonable" costs associated with (1) the investigation and resolution of the data breach; (Submitted: Jan 12, 2016 9:31:38 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 46
Exhbiti 1 (Saas) and 3 (Iaas) 19-Subscription terms.

Please clarify that this paragraph allows vendors to submit the click terms and conditions of software, and that these terms will become a part of the Master Agreement.

Exhibit 1 and 3-to Master Agreement Item 19- No Contractor terms, including standard click through license or website terms or use of privacy policy, shall apply to Purchasing Entities unless such terms are included in this Master Agreement . (Submitted: Jan 12, 2016 9:36:13 AM MST) Answer
- If an offeror has click through agreements or additional terms and conditions then it must attach them to its proposal. The agreement or additional terms and conditions will be negotiated and , if awarded a contract, will become a part of the final Master Agreement for that offeror.

This term is to prevent offerors from requiring purchasing entities to agree to click through agreements before using an offeror's service even though a Master Agreement and Participating Addendum have been signed. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 47
Exhibit 1 (SaaS), 2 (PaaS) and 3 (IaaS) 2. Data Protection a. Please allow additional language in quotation marks as vendor can only maintain security measures within their own organization.

2. a. The Contractor shall implement and maintain appropriate administrative, technical and organizational security measures "Add- within its own organization" to safeguard against unauthorized access, ... (Submitted: Jan 12, 2016 9:38:14 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 48
Exhibit 1 (Saas), 2 (Paas) and 3 (Iaas) 2. Data Protection e and f.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 305
#15..
- 636 -
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 48
Exhibit 1 (Saas), 2 (Paas) and 3 (Iaas) 2. Data Protection e and f.

Add language in quotation marks as data should be limited to what is intended for the exclusive use of the Purchasing Entity and exclusively in connection with the Master Agreement e. At no time shall any data or processes â€” that either belong to or are intended for the "Add- exclusive" use of a Purchasing Entity or its officers, agents or employees â€” be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the Purchasing Entity. f. The Contractor shall not use any information collected "Add-exclusively" in connection with the Services issued from this Master Agreement for any purpose other than fulfilling the Services. (Submitted: Jan 12, 2016 9:40:04 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 49
Exhibit 1 (Saas), 2 ((Paas) and 3 (Iaas) 3. Background Checks Add language in quotation marks as background check should be subject to applicable law8. Background Checks : Upon the request of the Purchasing Entity "ADD-and subject to applicable law," the Contractor shall conduct criminal background checks and not utilize any staff, including subcontractors, (Submitted:

Jan 12, 2016 9:41:22 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 50
Exhbiti 1, (Saas) 2 (Paas) and 3 (Iaas) 10. Contract Audit Please add language in quotation marks as notice should be reasonable and be performed during a Contractors normal working hours. Delete language in parenthesis.

Add language in blue as notice should be reasonable and be performed during a contractors normal working hours. , delete language in red-10.

Contract Audit: (Delete-The) "ADD-Upon reasonable written notice to the" Contractor, the Contractor shall allow the Purchasing Entity to audit conformance to the Master Agreement terms. The Purchasing Entity may perform this audit or contract with a third party at its discretion and at the Purchasing Entityâ€™s expense "ADD- during Contractorâ€™s normal business hours with minimum business disruption to Contractor. All audits shall be limited to records in the possession or control of Contractor that solely and directly relate to Contractorâ€™s performance under the Master Agreement and shall be treated by Purchasing Entity as confidential." (Submitted:

Jan 12, 2016 9:45:32 AM MST)
Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. If an offeror takes exception and.or additions to the Master Agreement Terms and Conditions, then Offeror must provide all documents in Microsoft Word format for redline editing. (Answered: Jan 12, 2016 2:26:19 PM MST)
Question 51
Exhibits 1 (Saas) 2, (Paas) and 3 (Iaas) 15. Import and Export of Data-Please clarify that "Contractors" should not be capitalized. (Submitted: Jan 12, 2016 9:46:48 AM MST) Answer
- Yes contractors should not be capitalized. (Answered: Jan 12, 2016 2:26:19 PM MST) Question 52
RFP Section 5.5.14- Please clarify that click through agreements and terms of use of respective manufacturers of the hardware and software products that encompass the proposed Cloud solution may be attached to a vendor's offer, and will be made a part of the Master Agreement. (Submitted: Jan 12, 2016 9:48:23 AM MST) Answer
- If an offeror has click through agreements or additional terms and conditions then it must attach them to its proposal. The agreement or additional terms and conditions will be negotiated and , if awarded a contract, will become a part of the final Master Agreement for that offeror. (Answered: Jan 12, 2016 2:26:19 PM MST) Question 53
RFP Section 3.12, paragraph 1 and RFP Section 5.1 call for a completed and signed RFP page which is to be provided by the Lead State as an attachment in BidSync.

This document is currently provided as a .htm file and also appears in the Packet_for_Bid with significant white space splitting the pagesCan the Lead State provide this a a printfriendly PDF and/or as an official standard State of Utah Bid CH16012
3/22/2016 4:23 PM p. 306
#15..
- 637 -
proposal. The agreement or additional terms and conditions will be negotiated and , if awarded a contract, will become a part of the final Master Agreement for that offeror. (Answered: Jan 12, 2016 2:26:19 PM MST) Question 53
RFP Section 3.12, paragraph 1 and RFP Section 5.1 call for a completed and signed RFP page which is to be provided by the Lead State as an attachment in BidSync.

This document is currently provided as a .htm file and also appears in the Packet_for_Bid with significant white space splitting the pages. Can the Lead State provide this a a print-friendly PDF and/or as an official standard form for us to complete and sign? (Submitted: Jan 12, 2016 1:47:50 PM MST) Answer
- This file will be uploaded as a separate document by 1/13/2016. (Answered: Jan 12, 2016 3:00:37 PM MST) Question 54
Per RFP 5.2.8, we are to provide a statement of proposal validity for 180 days from the â€œproposal opening date.â€ Does this mean the date the RFP was released or the date the Government opens proposal packages for evaluation? (Submitted: Jan 13, 2016 9:40:53 AM MST) Answer
- It means the date the government opens the proposals, which will be the closing date of the solicitation. (Answered: Jan 13, 2016 12:28:55 PM MST)
Question 55
RFP Section 1.1.1
Can state confirm that OEMs can use resellers as fulfillment partners to issue quotes, receive orders, and take payments directly from the customer?
Also, in addition to OEMâ€™s own cloud service offerings, can an OEM also offer separate value-added cloud service offerings of its authorized resellers, which may not otherwise be available on the OEMâ€™s price list? (Submitted: Jan 13, 2016 2:04:33 PM MST)
Answer
- OEMs can use resellers as fulfillment partners.

OEMs may only provide value-added services that have been included in the contract. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 56
RFP Section 3.16 â€“ As an OEM, we plan to use resellers if we are awarded this contract. Therefore, could such resellers use their Service Provider Identification Number or â€œSPINâ€ numbers in processing E-Rate orders? (Submitted: Jan 13, 2016 2:07:11 PM MST)
Answer
- Yes. (Answered: Jan 14, 2016 12:39:31 PM MST)
Question 57
Section 5.5.8
Section states "Offeror must at a minimum complete, provide, and maintain a completed a Level 1 CSA STAR Registry Self-Assessment and submit a copy under this RFP. Offeror must represent and warrant that it will keep this CSA Star Self-Assessment current on an annual basis and must be provide it to a Purchasing Entity when requested. Offeror must also represent and warrant the accuracy and currency of the information on the completed CSA Star Self-Assessment Form."
This appears contradicted by 8.13.a: "Level 1 CSA STAR Registry Self-Assessment complete an available through CSA STAR, as required by Mandatory Minimum 4.1.9."
Must the self assessment be uploaded to CSA STAR?. 5.5.8 implies that that is not necessary. (Submitted: Jan 13, 2016 2:10:22 PM MST)
Answer
- No the assessment does not need to be uploaded to CSA Star. The completed document needs to be attached to an Offeror's proposal. (Answered: Jan 25, 2016 2:23:05 PM MST) Question 58
Section 5.5.12
States that "Offeror, as part of its proposal, must provide a sample of its Service Level Agreement (SLA) that contains at a minimum, the terms described in Section 8.13 of the RFP" Section 8.13 describes the CSA STAR Assessment not SLA terms. What section should be referenced? (Submitted: Jan 13, 2016 2:11:49 PM MST)
Answer
- The section that should be referenced is 8.12. This change will be made in the final RFP document. (Answered:

Jan 14, 2016 12:39:31 PM MST)
Question 59
Section 8.1.1
Offerors are instructed to "Keep responses brief and to the point of how the service meets the requirement, within the indicated page limit."
Where is the indicated page limit stated? (Submitted: Jan 13, 2016 2:12:40 PM MST) Answer
- There is no page limit to this solicitation; however, Offerors are strongly encouraged to keep responses concise. (Answered: Jan 14, 2016 12:39:31 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 307
#15..
- 638 -
Section 8.1.1
Offerors are instructed to "Keep responses brief and to the point of how the service meets the requirement, within the indicated page limit."
Where is the indicated page limit stated? (Submitted: Jan 13, 2016 2:12:40 PM MST) Answer
- There is no page limit to this solicitation; however, Offerors are strongly encouraged to keep responses concise. (Answered: Jan 14, 2016 12:39:31 PM MST)
Question 60
Section 8.1.3
States "Offeror must identify for each service category(ies) the areas that each service category. For example if an Offeror provides a SaaS offering then it should be divided into education SaaS offerings, e-procurement SaaS offerings, information SaaS offering, etc. "
Please clarify, especially the first sentence. (Submitted: Jan 13, 2016 2:13:53 PM MST) Answer
- It should state that "Offeror must identify for each service category(ies) the subcategories for each service category."
If an Offeror provides SaaS services then it should provide a list of the subcategories within the SaaS category so that participating entities are aware of an offeror's services. (Answered: Jan 25, 2016 2:23:05 PM MST) Question 61
Section 8.16.5
"Ability to apply participating entity defined administration polices in managing solution" Please define which policies are relevant to solution management. (Submitted: Jan 13, 2016 2:14:52 PM MST) Answer
- 8.16.5 is modified as follows: "8.16.5 Ability to apply a participating entity's defined administration polices in managing a solution." (Answered: Jan 14, 2016 12:39:31 PM MST) Question 62

1. RFP, The General Provisions, paragraph 10. SALES TAX ID NUMBER (page 8 of the published 301 page RFP) states that it â€œrequires anyone filing a proposal with the state for the sale of tangible personal property or any other taxable transaction under UCA 59-12-103(1) to include their Utah sales tax license number with their proposal.â€ We have spoken with the Utah Tax Commission and they are unable to advise whether or not Cloud Solutions sales require a Utah Sales Tax ID Number. They suggested we ask NASPO ValuePoint for clarification. Our question: Do all Offerors have to obtain a Utah Sales Tax ID Number in order to be eligible to submit a proposal?

2. RFP, Master Agreement Terms and Conditions, Section 16. Insurance:
â€¢ What is the minimum insurance coverage for Data Breach and Privacy/Cyber Liability? â€¢ What are the â€œlow,â€ â€œmedium,â€ and â€œhighâ€ designations for Crime Insurance. What is meant by Crime Insurance? Please clarify what the different limits are for. â€¢ Can our Professional Liability and Cyber/Tech E&O policy be written on a claims-made basis? (Submitted: Jan 13, 2016 9:02:31 PM MST)
Answer
- 1. No. Offerors do not need to submit a Utah Sales Tax ID number to be eligible to submit a proposal. (Answered:

Jan 21, 2016 4:24:21 PM MST)
- 2. Crime insurance has been removed from Attachment A. The minimum insurance requirements are listed in Section 16 of the Master Agreement Terms and Conditions.

If an Offeror requests that the insurance be made on a claims-made basis then it need to take exception to the Master Agreement Terms and Conditions as described in the RFP document.

Low, Moderate, and High are defined as:

Low Risk Data is as defined in FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (â€œLow Impact Dataâ€ ).

Moderate Risk Data is as defined in FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (â€œModerate Impact Dataâ€ ).

High Risk Data is as defined in FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (â€œHigh Impact Dataâ€ ). (Answered: Jan 27, 2016 11:46:12 AM MST) Question 63

3. Cloud Service Types â€“ SaaS, IaaS, and PaaS. Is it permissible to bid on just one or two of these? Please confirm that Vendors are not required to submit all three?

4. RFP Section 4.3. Evaluation Process. Will each Cloud Service Type (SaaS, IaaS, and PaaS) be reviewed separately and graded on the 1375 point scale, or would all submittals combined be subject to a maximum technical proposal review of 1375 points?

5. RFP Section 3.1.1. Electronically Submitted Proposals â€“ Paragraph two states â€œAll attachments shall be submitted in a format acceptable to the Lead State. Acceptable formats include .doc (Microsoft Word Document), .xls (Microsoft excel spreadsheet), and .pdf (Adobe Acrobat portable document format). Will you also accept .docx format?

6. RFP Attachment B, Consensus Assessments Initiative Questionnaire (CAIQ), and Cloud Controls Matrix (CCM).

Please advise if Vendors should submit one or both of these for each Cloud Service Type (SaaS, IaaS, and PaaS) they are proposing. While we realize these are optional submittals, should one be prepared for each IaaS, Saas, PaaS that an Offeror submits?

7. Does the entire Q&A period end on January 29, 2016 at 12:00 p.m. MST? If so, please confirm that the deadline State of Utah Bid CH16012
3/22/2016 4:23 PM p. 308
#15..
- 639 -
submitted in a format acceptable to the Lead State. Acceptable formats include .doc (Microsoft Word Document), .xls (Microsoft excel spreadsheet), and .pdf (Adobe Acrobat portable document format). Will you also accept .docx format?

6. RFP Attachment B, Consensus Assessments Initiative Questionnaire (CAIQ), and Cloud Controls Matrix (CCM).

7. Does the entire Q&A period end on January 29, 2016 at 12:00 p.m. MST? If so, please confirm that the deadline for all questions to be answered is therefore also January 29, 2016 at 12:00 p.m. MST. If so, what is the last date/time that questions can be posted prior to the end of the Q&A Period? (Submitted: Jan 13, 2016 9:02:50 PM MST) Answer
- 7. The Q&A Period will end on January 29, 2016 at 12:00pm. However, the answering of questions may be posted after that deadline because some questions may be coming in on January 29, 2016 at 11:59. The State of Utah will to the best of its ability answer questions quickly. (Answered: Jan 14, 2016 12:39:31 PM MST) - 3. Offerors are not required to submit on all three. However, an Offerors proposal must be clear which Cloud Service Types it offers.

4. All submittals will be combined and be subject to a maximum technical proposal review of 1375.

5. Yes. .docx type is acceptable. (Answered: Jan 21, 2016 4:24:21 PM MST) - 6. The final RFP documents request that both documents be completed. And that only one be completed for both, but that it has enough detail to cover all of an Offeror's proposed services. (Answered: Jan 25, 2016 2:23:05 PM MST)
Question 64
1) Financial Requirements:

Section 6.3 on Financial of the RFP states:

Offeror must provide audited financial statements to the State and should meet a minimum Dun and Bradstreet (D&B) credit rating of 4A2 or better, or a recognized equivalent rating. Please provide the Respondentâ€™s D&B Number and the composite credit rating. The State reserves the right to verify this information. If a branch or wholly owned subsidiary is bidding on this RFP, please provide the D&B Number and score for the parent company that will be financially responsible for performance of the agreement.

Seeing as a credit rating 4A2 would require a minimum net worth of $10M, this does not seem applicable for a small business. The cloud community is comprised largely of small businesses in their infancy due to the newness of cloud technology. According to the State, what is an acceptable â€œrecognized equivalent ratingâ€ for a small business? (Submitted: Jan 14, 2016 8:23:14 AM MST) Answer
- The State has decided to modify the 4A2 to a 3A2 rating or the equivalent. (Answered: Jan 25, 2016 2:23:05 PM MST) Question 65
2) In your response to question #3 dated 12/31/2015, â€œIs it the intent of the State to exclude small businesses from this bid? The minimum D&B rating requirement is extremely exclusionary to small businesses and we would suggest that small businesses will offer the State the best opportunity for innovation in the fast moving cloud market.â€ the state wrote:
â€œThe participating states want some assurance that a vendor is financially stable and able to complete IT projects of this nature. States are putting significant amounts of tax payer dollars into a contractor to provide a solution. If a small business would like to participate on this effort and cannot qualify on their own, they may want to consider partnering with a larger firm in order to qualify.â€ However, section 5.7 of the RFP regarding the use of sub-contractors states that â€œAny Subcontractor that an Offeror chooses to use in fulfilling the requirements of the RFP must also meet all Administrative, Business and Technical Requirements of the RFP, as applicable to the Services provided.â€ Is it the intent of ValuePoint to remove the 4A2 requirement for subcontractors so that small businesses are able to qualify as stated in the answer above? (Submitted: Jan 14, 2016 8:23:30 AM MST)
Answer
- Yes. An Offerors' subcontractors do not need to comply with Section 4A2. (Answered: Jan 14, 2016 12:39:31 PM MST) Question 66
3) CSA â€“ As an authorized reseller and Advanced Consulting Partner, our company inherits the controls and security procedures from our IaaS provider. Are cloud brokers allowed to leverage the CSA from our cloud provider (ie, Amazon, Microsoft, Google, Softlayer, Virtustream) or do we need complete our own audit? (Submitted: Jan 14, 2016 8:23:46 AM MST)
Answer
- Yes. Cloud providers are able to leverage the CSA from their cloud providers. (Answered: Jan 14, 2016 12:39:31 PM MST)
Question 67
RFP Sections 8.12.4 and 8.12.5 appear to be unintentionally duplicated requirements. Please confirm. (Submitted: Jan 14, 2016 8:37:29 AM MST)
Answer
- RFP Section 8.12.5 has been deleted. It will be removed from the final version of the RFP. (Answered: Jan 14, 2016 12:39:31 PM MST)
Question 68
Question 62 and 63 are the upload of a total of 7 questions. Will these be answered separately? Do we need to State of Utah Bid CH16012
3/22/2016 4:23 PM p. 309
#15..
- 640 -
ppy pq
(Submitted: Jan 14, 2016 8:37:29 AM MST)
Answer
- RFP Section 8.12.5 has been deleted. It will be removed from the final version of the RFP. (Answered: Jan 14, 2016 12:39:31 PM MST)
Question 68
Question 62 and 63 are the upload of a total of 7 questions. Will these be answered separately? Do we need to re-upload each question as a separate upload in order to have each question answered? (Submitted: Jan 14, 2016 2:00:14 PM MST)
Answer
- The State will answer all of the questions in Questions 62 and 63 in the space provided for those questions.

So the questions do not need to be uploaded separately. (Answered: Jan 14, 2016 3:51:50 PM MST) Question 69
There are some sub-categories under the Saas, Paas and Iaas Service Types that we are not prepared to price today, but that are on our development roadmap; some to be released in as soon as 6 months, that could be pertinent to the services that Participating Entities are able to procure through this contract. The contract has a term of ten years, and certainly technology and service offerings will change over that period. Will there be a process to add capability to the scope of a vendor's contract offering(s) as new capabilities are developed? (Submitted: Jan 14, 2016 2:47:09 PM MST)
Answer
- Please see Section 2.8 that states: The awarded Master Agreement(s) may be modified as a result of technological upgrades for the procurement item(s). Any modification for upgraded technology must be substantially within the scope of the original procurement or contract, and if both parties agree to the modification, then the contract may be modified, but it may not extended beyond the term of the original awarded contract unless otherwise permitted by law. The awarded contract(s) may be modified for new technology related to the procurement item(s).

However, if an Offeror is not awarded a Service Category during this solicitation then an Offeror may attempt to be awarded a Service Category if the Lead State re-issues the solicitation, as permitted in 2.8. (Answered: Jan 15, 2016 11:56:21 AM MST)
Question 70
Section 5.3, Acknowledgement of Amendments, states: "If the RFP is amended, the Offeror must acknowledge each amendment with a signature on the acknowledgement form provided with each amendment. Failure to return a signed copy of each amendment acknowledgement form with the proposal may result in the proposal being found non-responsive.". We are not finding acknowledgement forms posted with the four amendments that are curenntly reflected in BidSync. Where can they be located? (Submitted: Jan 15, 2016 8:28:57 AM MST) Answer
- The acknowledgement form will be posted after all amendments to the RFP have been included in the final RFP documents. It is anticipated that the final RFP documents will be posted on February 5, 2016. The final RFP documents will not include new information, but will contain clarifications made as a result of the Q&A period. (Answered: Jan 15, 2016 11:56:21 AM MST)
Question 71
RFP Section 5.5.15 requires an Offeror to provide a statement certifying that it is willing to sign a Business Associate Agreement or any other agreement that may be necessary to protect data with a Purchasing Entity.

Statement: We cannot provide a blanket agreement to comply, as in the past, we have received certain HIPAA BAA's that are not relevant or applicable to our Cloud Services. Question: Will you please consider deleting the clause or revising the clause as written to be less restrictive? (Submitted: Jan 15, 2016 6:59:16 PM MST) Answer
- In the final version of the RFP document this section will be moved and deleted. It will not be in Section 8.9 and state: 8.9.2 Offeror must identify whether or not it is willing to sing relevant and applicable Business Associate Agreement or any other agreement that may be necessary to protect data with a Purchasing Entity.

Some Participating Entities want to know if an Offeror is willing to sign a BAA. (Answered: Jan 20, 2016 1:36:53 PM MST)
Question 72
Per RFP Section 3.10 Proposal Content and Format Requirements, reads in part, "Include a Table of Contents in the Technical Proposal identifying contents of each section, including page numbers of major sections.

Proposals should follow the numerical order of the RFP starting at the beginning and continuing through the end of the RFP, etc." AND, Per RFP Section 3.12 Submission of Proposal, covers the specific format for submitting Proposals. It reads in part, "Offerors should title each document with the names listed below." We will be submitting electronically only (not hard copy). Question: Do you want each proposal section to be uploaded as separate documents (i.e., Section 1 Signature Page, Section 2, Executive Summary, Section 3 Mandatory Minimums, Section 4 Business Profile) or do you want the core Proposal document to be contained in one document so that page numbers are consistently shown? Please clarify. Note: Section 3.12 does not mention the placement of the Cover Letter in terms of upload order. Please clarify or restate the upload criteria for the Proposal. ( We understand that all Attachments and Exhibits can be uploaded separately.) (Submitted: Jan 15, 2016 7:14:19 PM MST)
Answer
- A proposal can be uploaded as a single document or in multiple documents. If a proposal is uploaded as a ildt ththOffldtidtblf ttIf l ildd i
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 310
#15..
- 641 -
) yp
document so that page numbers are consistently shown? Please clarify. Note: Section 3.12 does not mention the placement of the Cover Letter in terms of upload order. Please clarify or restate the upload criteria for the Proposal. ( We understand that all Attachments and Exhibits can be uploaded separately.) (Submitted: Jan 15, 2016 7:14:19 PM MST)
Answer
- A proposal can be uploaded as a single document or in multiple documents. If a proposal is uploaded as a single document then the Offeror only needs to provide one table of contents page. If a proposal is uploaded in multiple documents then a table of contents should be created for each uploaded document.

However, Offerors should take into consideration that if an Offeror's proposal contains confidential information then the Offeror needs to upload two documents, an unredacted version and a redacted version. (Answered: Jan 20, 2016 1:36:53 PM MST)
Question 73
Please confirm that the recently posted "State of Utah Vendor Information" form is the RFP signature page, and also confirm that it replaces the original form provided in the RFP that was titled "State of Utah Request for Proposal." (Submitted: Jan 15, 2016 7:17:49 PM MST)
Answer
- The "State of Utah Vendor Information" is the RFP signature page. And it replaces the original form titled "State of Utah Request for Proposal." The original document did not format correctly when downloaded. (Answered: Jan 20, 2016 1:36:53 PM MST)
Question 74
Section 7.1 calls for the resume of the proposed "Contract Manager" with the only absolute requirement of 3 years experience managing cloud solution contracts. Section 5.5.1 describes a "Contracts Administrator" to manage compliance with the scope, terms, and conditions for the contract. Section 5.5.2 describes a "Usage Report Administrator" responsible for quarterly sales reporting as described in the MSA terms and conditions.

Request that the Government change "Contracts Administrator" and "Usage Report Administrator" to read "Contract Manager".

Request that the Government provide additional description of the expected roles and responsibilities, as well as any required skills and/or experience, for the "Contract Manager" position. (Submitted: Jan 18, 2016 12:04:51 PM MST) Answer
- Section 5.5.1 has been deleted from the final RFP document. However, 5.5.2 will remain the same. Offerors must provide a Usage Report Administrator to provide usage reports to NASPO ValuePoint and Participating Entities. The Usage Report Administrator can be the same person.

In order to meet the requirement of 5.5.2 an Offeror just needs to certify that it will, if awarded a contract, provide a Usage Report Administrator. (Answered: Jan 27, 2016 11:46:12 AM MST) Question 75
May other questions be answered via an attachment or an embedded document or embedded link? (Submitted:

Jan 18, 2016 1:57:51 PM MST)
Answer
- All questions will be answered through Bidsync. However, the RFP documents are subject to change based on the questions and answers. (Answered: Jan 20, 2016 1:36:53 PM MST) Question 76
Can we embed SLA attachments in our RFP response document? If not, how are they to be included in the response? (Submitted: Jan 18, 2016 1:58:43 PM MST)
Answer
- Please attach your SLA attachments to your RFP response. If in responding to a section a vendor needs to refer to its SLA attachments then it can simply reference the SLA attachments. (Answered: Jan 19, 2016 1:26:19 PM MST) Question 77
If multiple questions in the RFP, have essentially the same response details and that detail is 1-2 pages long, do you wish the vendor to a) repeat the answer after each question or b) refer back to the first time the answer appears in the RFP or c) provide full details once and provide highlights with reference back to the full answer in earlier question? e.g Security Policies. (Submitted: Jan 18, 2016 1:59:23 PM MST) Answer
- An Offeror can refer back to information as long as it is clear on which information it is referring back to. (Answered: Jan 20, 2016 1:36:53 PM MST)
Question 78
Two sections (7 & 8) refer to Personnel who will be involved at various stages (refer to the persons/roles identified in Section/Attachment D. Attachment D does not identify roles, please clarify.

Section 7:
7 ORGANIZATION AND STAFFING
This Section focuses on the individual persons and roles that will be involved in performance of the Master Agreement.Â The State has identified a number of roles that are necessary based on the requirements of Attachment D; these titles are not meant to be restrictive, but are used to identify key roles.Â The State recognizes that different Offerors may use different titles, have different organizational structures, and employ roles that have not been specifically identified by the State.Â For the roles that have been identified, provide the required information about the person/role that will meet the requirements identified by the State; feel free to provide the title your business uses for that roleÂ If multiple identified roles are performed by the same personbe sure to State of Utah Bid CH16012
3/22/2016 4:23 PM p. 311
#15..
- 642 -
7 ORGANIZATION AND STAFFING
This Section focuses on the individual persons and roles that will be involved in performance of the Master Agreement.Â The State has identified a number of roles that are necessary based on the requirements of Attachment D; these titles are not meant to be restrictive, but are used to identify key roles.Â The State recognizes that different Offerors may use different titles, have different organizational structures, and employ roles that have not been specifically identified by the State.Â For the roles that have been identified, provide the required information about the person/role that will meet the requirements identified by the State; feel free to provide the title your business uses for that role.Â If multiple identified roles are performed by the same person, be sure to include that information in your response.Â Â
Section 8:

8.3 (E) WORKING WITH PURCHASING ENTITIES
Describe in detail how you will work with Purchasing Entities before, during, and after a Data Breach, as defined in the Attachments and Exhibits.Â Include information such as:Â Â· Personnel who will be involved at various stages (refer to the persons/roles identified in Section 7);Â (Submitted:

Jan 18, 2016 2:01:12 PM MST)
Answer
- That paragraph in Section 7 has been deleted in the final RFP document.

Section 8.3 has been modified to state: "Personnel who will be involved at various stages, include detail on how the Contract Manager in Section 7 will be involved;" (Answered: Jan 27, 2016 11:46:12 AM MST) Question 79
Do we understand correctly that only Section 8 (Sections 8.1 - 8.24) must be answered SEPARATELY FOR EACH OFFERING BEING MADE for IaaS, SaaS, PaaS? If yes, then please confirm the proposal response will have two completed Sections 8, one following the other in the final Proposal. (Submitted: Jan 18, 2016 2:32:49 PM MST)
Answer
- If information can be provided for all three offering then an Offeror can provide one answer and identify that it applies to all three offerings. However, where an Offeror's proposal needs to identify different responses to the different sections for each offering then it can identify how it intends to respond. It can be done in one document or by splitting it out into multiple Section 8s. (Answered: Jan 20, 2016 1:36:53 PM MST) Question 80
Section 3.10 Proposal Content and Format Requirements Paragraph 1 states â€œInclude a Table of Contents in the Technical Proposal identifying the contents of each section, including page numbers of major sections.

Proposals should follow the numerical order of the RFP starting at the beginning and continuing through the end of the RFP. However in Section 3.12 submission of proposal paragraph 2 you mention â€œAll Proposals must be submitted in the following format. Offerors should title each document with the names listed below. Detailed information on submitting each of these sections is contained later sections of this RFP.â€ â€“ Do you require each proposal section to be uploaded as a separate document or should it be in one single document? Please confirm? (Submitted: Jan 19, 2016 10:34:18 AM MST)
Answer
- A proposal can be uploaded as a single document or in multiple documents. If a proposal is uploaded as a single document then the Offeror only needs to provide one table of contents page. If a proposal is uploaded in multiple documents then a table of contents should be created for each uploaded document.

The final version of the RFP document will not have the word "Technical". (Answered: Jan 20, 2016 1:36:53 PM MST) Question 81
RFP Section 3.10 states in part "Proposals should follow the numerical order of the RFP starting at the beginning and continuing through the end of the RFP. Proposal sections and subsections shall be identified with the corresponding numbers and headings used in the RFP." Question: Since no Vendor responses are required until Section 5. Mandatory Minimum Requirements, may the Proposal submittal begin with Section 5 (retaining the Section and Sub-Subsection numbering scheme as shown in the RFP)? (Submitted:

Jan 19, 2016 12:48:51 PM MST)
Answer
- Proposals should follow the format described in Section 3.12. (Answered: Jan 20, 2016 1:36:53 PM MST) Question 82
Section 1.a, would State please clarify whether State of Utah Standard Terms and Conditions take precedence over the master terms? (Submitted: Jan 20, 2016 10:01:30 AM MST) Answer
- A state's terms and conditions will take precedence over the master agreement terms and conditions if negotiated during the Participating Addendum stage. (Answered: Jan 20, 2016 1:36:53 PM MST) Question 83
Will the State entertain a reasonable limitation of liability, since global IT companies are very unlikely to enter into agreements which have no limitation on liability, especially given the nature of the cloud services to be provided under this RFP? (Submitted: Jan 20, 2016 10:02:08 AM MST) Answer
- Limitations of liability can be included in an Offeror's exceptions and/or additions to the Master Agreement Terms and Conditions. (Answered: Jan 20, 2016 1:36:53 PM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 312
#15..
- 643 -
Question 83
Will the State entertain a reasonable limitation of liability, since global IT companies are very unlikely to enter into agreements which have no limitation on liability, especially given the nature of the cloud services to be provided under this RFP? (Submitted: Jan 20, 2016 10:02:08 AM MST) Answer
- Limitations of liability can be included in an Offeror's exceptions and/or additions to the Master Agreement Terms and Conditions. (Answered: Jan 20, 2016 1:36:53 PM MST) Question 84
Section 2.3 Definitions
Eligible Users means every agency, political subdivision, or nonprofit that has the statutory authority to purchase from state cooperative contracts established by a Participating Entity to qualify for the cloud solutions described in the RFP. The Participating Entity will have sole discretion to determine who qualifies as an Eligible User.

Request that the Eligible Users be defined as those approved by the manufacturer. (Submitted: Jan 20, 2016 11:54:47

AM MST)
Answer
- Eligible Users of state cooperative contracts are determined by the Participating Entity/State. (Answered: Jan 20, 2016 1:36:53 PM MST)
Question 85
Sections 5.5.8, 5.5.9, and 5.5.10
o 5.5.8 Offeror must at a minimum complete, provide, and maintain a completed a Level 1 CSA STAR Registry Self-Assessment and submit a copy under this RFP. Offeror must represent and warrant that it will keep this CSA Star Self-Assessment current on an annual basis and must be provide it to a Purchasing Entity when requested.

Offeror must also represent and warrant the accuracy and currency of the information on the completed CSA Star Self-Assessment Form.
o 5.5.9 Offeror must provide a statement certifying that it agrees to adhere to the services, definitions, and deployment models identified in the Scope of Services, in Attachment D, during the term of the contract. o 5.5.10 Offeror must provide a statement that its auditing capabilities and reports are consistent with SAS 70 or later versions including, SSAE 16 6/2011, or greater.

Please confirm that the manufacturer/cloud service providerâ€™s ability to meet the requirements identified in these sections also satisfies the requirement for the reseller responding on the manufacturer/cloud service providerâ€™s behalf. (Submitted: Jan 20, 2016 11:56:21 AM MST) Answer
- Yes. If a provider can meet these requirements then it satisfies this requirement for resellers. (Answered: Jan 25, 2016 2:23:05 PM MST)
Question 86
Attachment B: Cloud Security Alliance Questionnaires
Please confirm whether the response requires both the CAIQ (Attachment B Exhibit 1) and CCM (Attachment B Exhibit 2) questionnaires, or if only one of the two is required. (Submitted: Jan 20, 2016 11:56:58 AM MST) Answer
- The final RFP document will require that both documents be attached to a proposal. (Answered: Jan 25, 2016 2:23:05 PM MST)
Question 87
Section 5.5.11
o 5.5.11 Offer must provide a statement acknowledging that all support and training shall be provided at no additional cost under the Master Agreement, except for customized support and training expressly requested by a Purchasing Entity.

Please delineate between â€œsupportâ€ and â€œtrainingâ€ and provide additional detail around expectations for each. (Submitted: Jan 20, 2016 11:57:33 AM MST) Answer
- Support may be technical support, while training is demonstrating a specific service so that a purchasing entity can use it. (Answered: Jan 20, 2016 1:52:45 PM MST)
Question 88
Section 5.5.14.
o Offeror must provide a statement acknowledging that no click-through, or other end user terms and conditions or agreements required by the Contract Vendor (â€œAdditional Termsâ€ ) provided with any Services hereunder shall be binding on Participating Entities or Purchasing Entities, even if use of such Services requires an affirmative â€œacceptanceâ€ of those Additional Terms before access is permitted, unless agree to in the Master Agreement Terms and Conditions or in a Participating Addendum.

Seeking clarification on â€œclick-throughâ€ terms. Please define â€œclick-throughâ€ terms. (Submitted: Jan 20, 2016 12:00:24 PM MST)
Answer
- The master agreement and participating addendums should contain all of the terms necessary for a purchasing entity and an awarded contractor to work together once a SLA is agreed upon.

Purchasing entities should not have to click through or agree to additional terms beyond what is in the master agreement and the relevant participating addendum. (Answered: Jan 20, 2016 1:52:45 PM MST) Question 89
Section 5613
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 313
#15..
- 644 -
Answer
- The master agreement and participating addendums should contain all of the terms necessary for a purchasing entity and an awarded contractor to work together once a SLA is agreed upon.

Purchasing entities should not have to click through or agree to additional terms beyond what is in the master agreement and the relevant participating addendum. (Answered: Jan 20, 2016 1:52:45 PM MST) Question 89
Section 5.6.13
o 5.6.13 Offeror must provide a statement certifying that its scale-up and scale-down is available 24x365, and that new instances can be added in one hour or less.

Please clarify what is intended by the â€œscale-up and scale-downâ€ requirement for non-metered subscription services, such as SaaS. (Submitted: Jan 20, 2016 12:01:16 PM MST) Answer
- This section will not apply to SaaS services. If a section is not applicable to its offering then an Offeror must identify and explain why it is not applicable. However, if an Offerors identifies a section as not applicable to its proposal then it could hinder an Offeror's contract award. (Answered: Jan 20, 2016 1:52:45 PM MST) Question 90
Section 5.6.12 and 5.6.15
o 5.6.12 Offeror must provide a statement certifying that its on-demand deployment is supported 24x365. o 5.6.15 Offeror must provide a statement certifying that on-demand support is provided 24x365.

Please explain the intended difference between these requirements. (Submitted: Jan 20, 2016 12:01:37 PM MST) Answer
- Section 5.6.15 will be deleted from the final version of the RFP document. (Answered: Jan 20, 2016 1:36:53 PM MST) Question 91
Currently we do not hold any 3rd party certifications (security, process, quality, etc). Are the certification mandatory to be considered for this bid? If so which ones must we have to submit an RFP that will be considered for review. (Submitted: Jan 20, 2016 12:16:12 PM MST)
Answer
- 3rd Party Certification are not required. If an Offeror does not have any certifications it must state so. However, if an Offeror does not have any third party certifications then it may affect the Offerors technical score. (Answered: Jan 27, 2016 11:46:12 AM MST)
Question 92
Section 5.7 and Section 8.2. Subcontractors
In the SaaS model, a manufacturer will provide cloud services. Because of this involvement, as a reseller, are we to classify the manufacturer/cloud service provider as our subcontractor, the cloud service provider, or both? (Submitted: Jan 20, 2016 12:29:52 PM MST)
Answer
- Can you define who "we" is in your question?
Thank you. (Answered: Jan 27, 2016 11:46:12 AM MST)
Question 93
Section 6.2 Scope of Experience
â€¢ 6.2.1 Describe in detail the businessâ€™ experience with government or large consortium contracts similar to the Master Agreements sought through this RFP. Provide the approximate dollar value of the businessâ€™ five (5) largest contracts in the last two (2) years, under which the business provided services identical or very similar to those required by this RFP. Government experience is preferred. â€¢ 6.2.2 Describe in detail the size and scope of the cloud solutions for which you have provided the types of services required by in this RFP.

Please confirm that the cloud service providerâ€™s experience can be utilized to satisfy this requirement for the reseller that is responding on behalf of the cloud service provider. (Submitted: Jan 20, 2016 12:30:36 PM MST) Answer
- Section 6.2 refers to the Offeror responding to the solicitation. (Answered: Jan 20, 2016 1:42:41 PM MST) Question 94
Section 2.12 and Attachment D: Scope of Services
o 2.12 During the term of the Master Agreement(s), Offerors may submit a request to update the awarded Services as services are introduced or removed from the Offerorâ€™s offerings. o Attachment D: A successful Offeror must provide at least one of the following cloud based service models [SaaS, PaaS, IaaS] in order to be considered for award.

Please confirm that if a bidder responds with only one cloud based service model, ex. SaaS, and if awarded a contract, it is acceptable to add other cloud based service models (PaaS and/or IaaS) to the contract, that were originally in scope of the RFP, at a later date. (Submitted: Jan 20, 2016 12:32:06 PM MST) Answer
- Section 2.12 allows awarded contractors the ability to update their price schedules or product lists for awarded categories. For example, if an awarded contractor is awarded a contract to provide only SaaS services then it can request to update its price schedule or product list for only SaaS services. An awarded contract cannot add on a new service model.

However, an awarded contractor can submit a proposal to include a new service model if the Lead State reissues a solicitation under Section 2.8. (Answered: Jan 20, 2016 1:41:12 PM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 314
#15..
- 645 -
Answer
- Section 2.12 allows awarded contractors the ability to update their price schedules or product lists for awarded categories. For example, if an awarded contractor is awarded a contract to provide only SaaS services then it can request to update its price schedule or product list for only SaaS services. An awarded contract cannot add on a new service model.

However, an awarded contractor can submit a proposal to include a new service model if the Lead State reissues a solicitation under Section 2.8. (Answered: Jan 20, 2016 1:41:12 PM MST) Question 95
Is there a tentative award date that can be shared? (Submitted: Jan 20, 2016 12:32:55 PM MST) Answer
- As soon as all of the proposals have been evaluated and scored then the State of Utah will award the contracts. (Answered: Jan 20, 2016 1:36:53 PM MST)
Question 96
If a cloud service providerâ€™s (CSP) business model is to sell its solutions to end users via agents whom represent the CSP, will the State/NASPO allow the CSP to add agents under them on their contract for fulfillment of their product? (Submitted: Jan 20, 2016 1:54:51 PM MST) Answer
- Yes. (Answered: Jan 25, 2016 11:40:18 AM MST)
Question 97
Section 5.8, Recertification. The section states that the vendor needs to commit to certify every year with the lead State (Utah) that we continue to meet the minimum requirements of the RFP.

Is there a requirement to also certify/recertify with individual State participants as well? (Submitted: Jan 20, 2016 1:56:19 PM MST)
Answer
- Currently there is no requirement to also have an awarded contract recertify with each state. However, a state may request recertification in its Participating Addendum. (Answered: Jan 21, 2016 4:24:21 PM MST) Question 98
How will or does the NASPO ValuePoint eMarket Center support the ordering and the provisioning of cloud based services (which are not simple drop-ship products/services)? (Submitted: Jan 20, 2016 2:28:06 PM MST) Answer
- Sections of the RFP will be modified as a result of this question including Section 39 of the Master Agreement Terms and Conditions, as follows:

The awarded cloud service contractors will not have any type of catalog within the eMarket Center, they will have Ordering Instructions. These instructions provide visibility to the contractor within the eMarket Center as well as provide information about the contractor and how to order directly from the contractor, outside of the eMarket Center.

39. NASPO ValuePoint eMarket Center: In July 2011, NASPO ValuePoint entered into a multi-year agreement with SciQuest, Inc. whereby SciQuest will provide certain electronic catalog hosting and management services to enable eligible NASPO ValuePointâ€™s customers to access a central online website to view and/or shop the goods and services available from existing NASPO ValuePoint Cooperative Contracts. The central online website is referred to as the NASPO ValuePoint eMarket Center.

The Contractor will have visibility in the eMarket Center through Ordering Instructions. These Ordering Instructions are available at no cost to the Contractor and provided customers information regarding the Contractors website and ordering information.

39. NASPO ValuePoint eMarket Center: In July 2011, NASPO ValuePoint entered into a multiyear agreement with SciQuest, Inc. whereby SciQuest will provide certain electronic catalog hosting and management services to enable eligible NASPO ValuePointâ€™s customers to access a central online website to view and/or shop the goods and services available from existing NASPO ValuePoint Cooperative Contracts. The central online website is referred to as the NASPO ValuePoint eMarket Center.

At a minimum, the Contractor agrees to the following timeline: NASPO ValuePoint eMarket Center Site Admin shall provide a written request to the Contractor to begin Ordering Instruction process. The Contractor shall have thirty (30) days from receipt of written request to work with NASPO ValuePoint to provide any unique information and ordering instructions that the Contractor would like the customer to have. (Answered: Jan 27, 2016 11:46:12 AM MST)
Question 100
Regarding the State Specific Terms and Conditions in Attachment E, are those binding on the Contract Vendor once the Master Agreement is awarded? Or will the Contract Vendor have the chance to negotiate with the State during the Participating Addendum process? (Submitted: Jan 20, 2016 4:37:21 PM MST) Answer
- The state specific terms and conditions are not binding, but are for reference only. An awarded contractor will be allowed to negotiate the state specific terms and conditions during the Participating Addendum process. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 101
Regarding the State Specific Terms and Conditions in Attachment E, are those binding on the Contract Vendor once the Master Agreement is awarded? Or will the Contract Vendor have the chance to negotiate with the State during the Participating Addendum process? (Submitted: Jan 20, 2016 4:37:35 PM MST) Answer
- The state specific terms and conditions are not binding, but are for reference only. An awarded contractor will be allowed to negotiate the state specific terms and conditions during the Participating Addendum process. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 102
Section 5 of the RFP reads:

MANDATORY MINIMUM REQUIREMENTS
This section contains mandatory minimum requirements that must be met in order for an Offerorâ€™s proposal to be considered for the technical evaluation phase of the RFP. Failure to meet any one of the mandatory minimum requirements will result in the proposal being rejected pursuant to UCA Â§ 63 G-6a-704 and the proposal will not move forward in the evaluation process.

All of the items described in this section are non -negotiable. A rejection of a proposal due to a proposal not meeting mandatory minimum requirements can occur at any time in the evaluation process
Offerors are required to provide a point-by-point response to each of the following mandatory minimum requirements:

Several of requirements do not apply to some of the products we intend to bid.

How can indicate that the individual requirements does not apply to a specific product we are proposing without having our proposal rejected? (Submitted: Jan 20, 2016 7:30:14 PM MST) Answer
- If a mandatory minimum does not apply to a specific product the vendor is proposing then an offeror may state in its response why the mandatory minimum is not applicable. The State of Utah reserves the right to clarify if it believes the mandatory minimum is applicable. (Answered: Jan 21, 2016 4:24:21 PM MST) Question 103
Will the State of Utah's Participating Agreement Terms and Conditions be negotiated after award of the Master Agreement, or since Utah is the lead State, will their Participating Agreement Terms and Conditions be a part of the Master Agreement award? (Submitted: Jan 21, 2016 6:21:19 AM MST) Answer
- The State of Utah's terms and conditions will be negotiated during the Participating Addendum stage. (Answered:

Jan 21, 2016 4:24:21 PM MST)
Question 104
Please confirm that offerors may submit differing minimum discounts by vendor for each of the product categories identified (SaaS, IaaS, PaaS) in Attachment G. (Submitted: Jan 21, 2016 10:25:47 AM MST) Answer
- Correct, Offerors may submit differing minimum discounts. (Answered: Jan 21, 2016 4:24:21 PM MST) Question 105
Please confirm that offerors must submit a price catalog with detailed product offerings for each category by line item, to include manufacturer name, manufacturer part number, list price, product category, and sub category (e.g., education SaaS, e-procurement SaaS, information SaaS, etc.) as applicable. (Submitted: Jan 21, 2016 10:26:49 AM MST)
Answer
CorrectOfferors must submit a price catalog with detailed product offerings for each category by line itemto State of Utah Bid CH16012
3/22/2016 4:23 PM p. 316
#15..
- 647 -
Question 105
Please confirm that offerors must submit a price catalog with detailed product offerings for each category by line item, to include manufacturer name, manufacturer part number, list price, product category, and sub category (e.g., education SaaS, e-procurement SaaS, information SaaS, etc.) as applicable. (Submitted: Jan 21, 2016 10:26:49 AM MST)
Answer
- Correct, Offerors must submit a price catalog with detailed product offerings for each category by line item, to include manufacturer name, manufacturer part number, list price, product category, and sub category (e.g., education SaaS, e-procurement SaaS, information SaaS, etc.) as applicable. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 106
Section 3.13 of the RFP notes that "Pricing may not be classified as confidential or protected and will be considered public information after award of the contract." Please confirm that pricing may be classified as confidential prior to award; it is understood that pricing will be considered public information following award. (Submitted: Jan 21, 2016 10:27:22 AM MST)
Answer
- Proposals and pricing will be confidential until contract award. (Answered: Jan 21, 2016 4:24:21 PM MST) Question 107
What is the criteria for allocating the 152.8 points in the evaluation of cost proposals? (Submitted: Jan 21, 2016 10:27:46 AM MST)
Answer
- If a vendor completes the Cost Proposal form and provides a minimum discount for each category then it will be awarded the full 152.8 points. (Answered: Jan 25, 2016 2:06:20 PM MST) Question 108
Would an implementation timeline be acceptable to meet the security requirements? (Submitted: Jan 21, 2016 12:11:16 PM MST)
Answer
- It may be acceptable, but an Offeror must provide enough detail to the implementation timeline to describe how it meets the security requirements. If the evaluation committee does not believe it meets the security requirements then it may be scored lower. (Answered: Jan 27, 2016 11:46:12 AM MST) Question 109
If we take exception to security requirements will we be able to provide our current security protocol? (Submitted:

Jan 21, 2016 12:11:30 PM MST)
Answer
- An Offeror's proposal must include its current security protocol, which must meet or exceed the security requirements listed in the RFP. (Answered: Jan 27, 2016 11:46:12 AM MST) Question 110
If we take exception to security requirements will we be able to provide our current security protocol? Will the vendor receive partial points or zero points? (Submitted: Jan 21, 2016 12:11:45 PM MST) Answer
- An Offeror's proposal must include its current security protocol, which must meet or exceed the security requirements listed in the RFP.

Points will be determined by the evaluation committee. (Answered: Jan 27, 2016 11:46:12 AM MST) Question 111
In the service level agreement is it a general service agreement or an individual (customer) agreement? (Submitted: Jan 21, 2016 12:11:57 PM MST)
Answer
- The service level agreement should be the one that the Offeror intends to use if awarded contract. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 112
In reference to Section 3.12 Submission of Proposal, in particular the sentence "Offerors should title each document with the names listed below." Does NASPO VP/ State of Utah want a separate/ individual document file for each Section Title, or can Offerors present responses for each section, aside from the Cost Proposal, in one single document file? (Submitted: Jan 21, 2016 2:50:40 PM MST) Answer
- An Offeror may submit its response as one document or multiple documents. (Answered: Jan 21, 2016 4:24:21 PM MST)
Question 113
In line with this RFP of providing public entities with choices of qualified Offerors, multiple States have historically leveraged the below proposal wording - Are Joint Proposals allowed for this contract? Joint Proposals: A joint proposal (2 or more bidders proposing jointly on a single proposal) may be submitted.

Each participating bidder must sign the joint proposal. If the contract is awarded to joint bidders, it shall be one indivisible contract. Each joint bidder will be jointly and severally responsible for the performance of the entire contract, and the joint bidders must designate, in writing, one individual having authority to represent them in all matters relating to the contract. The State assumes no responsibility or obligation for the division of orders or purchases among the joint bidders. (Submitted: Jan 22, 2016 11:55:58 AM MST) Answer
- Yes. (Answered: Jan 25, 2016 2:06:20 PM MST)
Question 114
In Attachment G, Cost Schedule, can the Offeror add additional Value Added Services categories and provide separate pricing for those additional categories? (Submitted: Jan 22, 2016 12:53:51 PM MST) Answer
- Yes.The cost proposal form has been modified to reflect this question. (Answered: Jan 25, 2016 2:06:20 PM MST) Question 115
In Exhibit 1 to Attachment A, Paragraph 2.d, if the Contractor is a reseller and not the provider, the reseller does not have the ability to encrypt the Non-Public Data. It would be the responsibility of the provider. How should the Offeror distinguish between what the reseller is responsible for and what the provider is responsible for? (Submitted: Jan 22, 2016 12:54:31 PM MST)
Answer
- Offerors need to describe in their proposals what they are responsible for and what providers are responsible for, but wih (Answered: Jan 28, 2016 2:00:48 PM MST)
Question 116
In reference to Section 7. Organization and Staffing, the RFP states, "The State has identified a number of roles that are necessary based on the requirements of Attachment D..." Did Utah/NASPO VP intend to list additional roles beyond that of the Contract Manager? (Submitted: Jan 22, 2016 12:59:09 PM MST) Answer
- Section 7 has been modified to only reference the Contract Manager role. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 117
If a Reseller is submitting offerings to be provided through our CSP partners, are they consider subcontractors under this contract and subject to section 8.2 of the RFP? (Submitted: Jan 22, 2016 1:01:39 PM MST) Answer
- Any Offeror submitting a proposal must address each mandatory minimum requirement and technical evaluation criteria. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 118
Question 1 (Reference RFP 9.1):

RFP 9.1 states: â€œâ€¦ it is more favorable for Purchasing Entities to have the Master Agreement be based on minimum discounts off the Offerorâ€™sâ€™ commercially published pricelists versus fixed pricing.â€ Many cloud providers do not maintain published pricelists. Will offerors that do not have commercially published pricelists be considered for award of a Master Agreement? Question 2 (Reference RFP 9.1):

RFP 9.1 states: â€œThe hourly rates should be a fully burdened rate that includes labor, per diem, travel, overhead, and any other costs related to the service.â€ We recommend that the hourly rates include labor, overhead, and fee, but not per diem and travel costs since per diem and travel costs will vary widely and cannot be estimated at this time.

Question 3 (Reference Attachment A, Section 19):

Please clarify how services will be ordered under this Master Agreement. In particular:
1) Will ordering entities release task order requests/solicitations that firms having a Master Agreement are allowed to bid to?
2) Will all firms having a Master Agreement be allowed an opportunity to bid on a task order/solicitation? 3) Does a firm have the option of not bidding on a particular task order/solicitation? 4) Can an entity order directly from a firmâ€™s pricelist without going through a task order/solicitation process? (Submitted: Jan 22, 2016 2:07:11 PM MST)
Answer
- 1. Offerors must provide a price list so that the Participating States know how much an Offerors services may cost.

2. Agreed. Per diem and travel will be removed from the final RFP documents.

3. If an Offeror is awarded a contract then an Offeror must negotiate a Participating Addendum with Participating Entities (States). If awarded a Master Agreement it does not guarantee that a Participating Entity will sign a Participating Addendum with an offeror. (Answered: Jan 25, 2016 2:02:24 PM MST) Question 119
With respect to section 5.2.5, if a parent company and a subsidiary planned to submit separate bids, can an employee of the parent company assist in the preparation of both? (Submitted: Jan 22, 2016 3:32:18 PM MST) Answer
- Yes. (Answered: Jan 25, 2016 11:40:18 AM MST)
Question 120
To meet minimum requirements, are Exhibit 1 to Attachment B - CAIQ v3.0.1-09-16-2014.xls) and Exhibit 2 to Attachment B - CSA_CCM_v3.0.1-09-16-2014.xlsx expected to be completed? I don't see these listed as a set of minimum requirements. (Submitted: Jan 25, 2016 1:56:09 PM MST) Answer
- 5.5.8 Offeror must at a minimum complete, provide, and maintain a completed a Level 1 CSA STAR Registry Self-Assessment and submit a copy under this RFP. Offeror must represent and warrant that it will keep this CSA Star Self-Assessment current on an annual basis and must be provide it to a Purchasing Entity when requested.

Offeror must also represent and warrant the accuracy and currency of the information on the completed CSA Star Self-Assessment Form. (Answered: Jan 25, 2016 2:08:52 PM MST) Question 121

8.17.1 Documented cloud hosting provisioning processes, and the your defined/standard cloud provisioning stack.

Please clarify what is meant by cloud provisioning stack and/or provide examples. Specifically interested in the context of SaaS. (Submitted: Jan 25, 2016 2:27:38 PM MST) Answer
- If this section does not apply to SaaS then Offerors offering SaaSare required to describe why it is not applicable in their proposals. (Answered: Jan 27, 2016 1:00:04 PM MST) Question 122
Â¶ Section 3.9 & 3.12 Pg. 12 Paragraph numbering sequence. The Paragraph sequencing skips 3.10 and

3.11. Is there missing content? Please clarify. (Submitted: Jan 26, 2016 4:45:52 AM MST) Answer
- This was a numbering issue that will be corrected in the final version of the RFP documents. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 123
Â¶ 4.1.2 Pg. 16 Offerors are encouraged to demonstrate compliance with a mandatory minimum and to demonstrate that they exceed to the requirement. The phase â€œexceed to the requirementâ€ is confusing.

Was â€œaccede to the requirementâ€ intended? (Submitted: Jan 26, 2016 4:46:18 AM MST) Answer
- The sentence you are referring to in 4.1.2 has been modified to the following: "Offerors are encouraged to demonstrate compliance with a mandatory minimum and to demonstrate that they meet or exceed to the requirement." (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 124
Â¶ 5.6.6 Pg. 23 Offeror must provide a statement certifying that it on request you can isolate that data to servers and data centers residing entirely in the United States of America or its territories. Please reword for clarity. (Submitted: Jan 26, 2016 4:46:39 AM MST)
Answer
- Offeror must certify that it can isolate that data, if required, to servers and data centers residing entirely in the United States of America or its territories.

Certain Purchasing Entity data must reside in the United States.

If an Offeror cannot meet this mandatory minimum requirement it will not be rejected, but it will restrict the type of award the Offeror can receive. (Answered: Jan 27, 2016 1:00:04 PM MST) Question 125
Â¶ 7.1 Pg. 27 It is this offerors opinion that the minimum requirement for Contract Manager, â€œ3 yearsâ€ experience managing contracts for cloud solutionsâ€ , is un-necessarily restrictive due primarily to newness and developing cloud market place. This offeror recommends removing the â€œmandatoryâ€ language and evaluate the yearsâ€™ experience only. i.e. Change from (ME) to (E). (Submitted: Jan 26, 2016 4:47:03 AM MST) Answer
- The minimum requirement will remain, but the three years will be removed. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 126
Â¶ 8.12.1 Pg. 31 â€œAdditional points will be awarded for 99.99% or greater availabilityâ€ Base on the language of Â¶ 8.12.1 can the maximum points for Â¶ 8.12 exceed 50? (Submitted: Jan 26, 2016 4:47:29 AM MST) Answer
- No the expectation is that an Offeror can guarantee reliability and uptime greater than 99.9%, which would result in 30 points. If an offerors provides greater availability then it could receive 40 or 50 points. (Answered: Jan 27, 2016 1:00:04 PM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 319
#15..
- 650 -
Question 126
Â¶ 8.12.1 Pg. 31 â€œAdditional points will be awarded for 99.99% or greater availabilityâ€ Base on the language of Â¶ 8.12.1 can the maximum points for Â¶ 8.12 exceed 50? (Submitted: Jan 26, 2016 4:47:29 AM MST) Answer
- No the expectation is that an Offeror can guarantee reliability and uptime greater than 99.9%, which would result in 30 points. If an offerors provides greater availability then it could receive 40 or 50 points. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 127

5.5.3 Pg 25 SciQuest: Offeror must agree to cooperate with NASPO ValuePoint and SciQuest (and any authorized agent or successor entity to SciQuest) with uploading ordering instructions Will the state provide vendors with detail requirements that they must provide to SciQuest for ordering instructions? (Submitted: Jan 26, 2016 7:06:07 AM MST)
Answer
- Offerors that are awarded contract must provide their orders instructions to SciQuest there are no detailed requirements. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 128
Â¶ 8.23 (E) Pg. 33 RFP requires a response to review Cyber Insurance requirements as detailed in Attachment A (Master Agreement). If you have cyber insurance, what levels of protection does it provide to Purchasing Entities.

Will the state please clarify the intent for this response? The Offeror understands that in its proposal response, it will include whether or not it has Cyber Insurance and to what level detailed in Attachment A; however, we ask for clarification regarding what Cyber Insurance coverage is required to be offered to Purchasing Entities. (Submitted:

Jan 26, 2016 7:06:45 AM MST)
Answer
- 8.23 has been deleted from the final RFP documents.

Offerors must review Attachment A for Cyber Insurance requirements. (Answered: Jan 27, 2016 1:00:04 PM MST) Question 129
Â¶ Bid Sync Questions Close Period January 29, 2016 Based on answers provided after the question close period, if additional clarification is required will the government consider additional questions to clarify those responses? (Submitted: Jan 26, 2016 7:07:29 AM MST)
Answer
- No. The question and answer period ends on January 29th. (Answered: Jan 27, 2016 1:00:04 PM MST) Question 130
Â¶ 3.8 Pg. 11
Â¶3.11.1 Pg. 11
Â¶3.11.2 Pg. 12
Â¶3.9.3 Pg. 13
Â¶3.12 Pg. 10
Â¶4.3 Pg. 18
Multiple references to â€œcostâ€ and â€œcost proposal.â€ This Offeror understands â€œcostâ€ in these instances to mean â€œpriceâ€ and not the actual cost build up behind the prices proposed for products or services within our proposal response.

Please clarify the Stateâ€™s meaning when using â€œcostâ€ as detailed in this question. (Submitted: Jan 26, 2016 7:09:39 AM MST)
Answer
- In these sections "cost" has been replaced with "cost proposal". (Answered: Jan 27, 2016 1:00:04 PM MST) Question 131
Attachment G â€“ Cost Proposal N/A Onsite and Remote Hourly Rates To accommodate a 10 year contract term and adjust for cost increase over time, will vendors be able to increase their Onsite and Remote rates during the contract term? Would the State consider using a published index (i.e. CPI) for annual rate increases? (Submitted: Jan 26, 2016 7:10:05 AM MST)
Answer
- Yes. Annual increases are acceptable, but only if the awarded contractor is able to demonstrate that the price increase is justified, such as by using a published index. (Answered: Jan 27, 2016 1:00:04 PM MST) Question 132

5.2.5 Pg. 20 In the cover letter, an Offeror must include a statement that it hasnâ€™t employed any company or person other than an employee or a company regularly employed as a marketing agent to respond to the RFP.

Will the State please clarify the intent of this requirement? Is the intent to determine whether a lobbyist has been or will be utilized or is the intent to determine whether the proposal response has been written by a person or company other than the Offerorâ€™s? (Submitted: Jan 26, 2016 7:10:32 AM MST) Answer
- The intent is to determine who helped the Offeror write its proposal to ensure that no conflict of interest is present. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 133
RFP Section 1 Last sentence If any provision of this RFP conflicts with the UCA or UAC, the UCA or UAC will take precedenceException
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 320
#15..
- 651 -
Answer
- The intent is to determine who helped the Offeror write its proposal to ensure that no conflict of interest is present. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 133
RFP Section 1 Last sentence If any provision of this RFP conflicts with the UCA or UAC, the UCA or UAC will take precedence. Exception
Microsoft respectfully takes exception to this requirement, as written. Microsoft complies with all laws applicable to it, both as an IT service provider and as a corporation, in general. However, Microsoft does not agree to comply with laws applicable solely to its Purchasing Entities and their government or industry functions. (Submitted: Jan 26, 2016 7:10:39 AM MST)
Answer
- This section is used to ensure that the procurement is performed in accordance with Utah's procurement laws. (Answered: Jan 27, 2016 1:00:04 PM MST)
Question 134
RFP Section 2.2 Contract Vendors must submit an annual certification that they are still compliant with the mandatory minimum requirements and technical specification of the RFP Exception Microsoftâ€™s Online Services are subject to change, so Microsoft is unable to agree to maintain static technical specifications for the duration of the Master Agreement. To the extent that Microsoft has identified protective security and privacy terms and conditions in its Online Services Terms (OST), with respect to those services the OST expressly applies to, Microsoft will not diminish those terms and conditions with respect to those specific products. (Submitted: Jan 26, 2016 7:10:55 AM MST)
Answer
- The annual certification is intended to ensure that all awarded contractor still comply with the terms of the contracts and can still provide the offerings as specified in the Master Agreement. (Answered: Jan 28, 2016 9:57:54

AM MST)
Question 135
Â¶ 38. Pg. 23 No Guarantee of Service Volumes: The Contractor acknowledges and agrees that the Lead State and NASPO ValuePoint makes no representation, warranty or condition as to the nature, timing, quality, quantity or volume of business for the Services or any other products and services that the Contractor may realize from this Master Agreement, or the compensation that may be earned by the Contractor by offering the Services. The Contractor acknowledges and agrees that is has conducted its own due diligence prior to entering into this Master Agreement as to all the foregoing matters. Will the state please clarify the bolded language to clarify the stateâ€™s intent? (bold added to highlight for questions) This Offeror agrees we should conduct reasonable due diligence but the wording is unclear. Does "all the foregoing matters" refer to Service Volumes (as the content of the specific paragraph). If not, please specify what this language means. (Submitted: Jan 26, 2016 7:11:05 AM MST) Answer
- The intent of this term and condition is to ensure that Offerors understand that even by being awarded a contract that there is no guarantee of use by any of the purchasing entities. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 136
RFP Section 2.7.2 Master Agreement
The Master Agreement(s) awarded from this RFP will consist of the RFP document, including all Exhibits, Attachments, and the winning Offerorâ€™s Proposal, in that order of precedence. Exception.

Offeror respectfully takes exception to the requirement to incorporate Exhibit E. While Exhibit E contains the boilerplate of Participating Addenda proposed by certain Participating States, it is unreasonable to expect Offeror to have prepared detailed Exception statements for each of the provisions in that 143 page document prior to engaging in negotiation with each of the individual Participating States after award, in accordance with RFP Sections 2.7.3 and 5.2.3.

Additionally, neither Appendix C nor Appendix D are written in such a way as to constitute contract terms, per se.

While offeror does not take exception to following the instructions for submitting information with as required by those Appendices, Offeror respectfully asks that those Appendices be struck from the â€œEntire Agreement,â€ as they contain no terms and conditions, per se. (Submitted: Jan 26, 2016 7:11:18 AM MST) Answer
- The Master Agreement will contain the following documents:
(1) A Participating Entityâ€™s Participating Addendum (â€œPAâ€ ); (2) NASPO ValuePoint Master Agreement Terms & Conditions, including the applicable Exhibits to the Master Agreement;
(3) The Solicitation;
(4) Contractorâ€™s response to the Solicitation, as revised (if permitted) and accepted by the Lead State; and (5) A Service Level Agreement issued against the Participating Addendum. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 137
Exceptions to scope/content of the RFP within an Offerorâ€™s proposal that have not been previously addressed within the Q&A period of the procurement are not allowed and may result in the Offerorâ€™s proposal being considered non-responsive. Exception.

While Microsoft and Offeror have endeavored to submit during the Q&A period all Exceptions made necessary by our current understanding of the RFP requirements, it is possible that the answers we later receive from the Lead State to our questions (and those of other vendors) may cause us to reevaluate our interpretation of requirements, in light of those answersMicrosoft and Offeror therefore reserve the right to add any Exceptions that may result State of Utah Bid CH16012
3/22/2016 4:23 PM p. 321
#15..
- 652 -
Question 137
Exceptions to scope/content of the RFP within an Offerorâ€™s proposal that have not been previously addressed within the Q&A period of the procurement are not allowed and may result in the Offerorâ€™s proposal being considered non-responsive. Exception.

While Microsoft and Offeror have endeavored to submit during the Q&A period all Exceptions made necessary by our current understanding of the RFP requirements, it is possible that the answers we later receive from the Lead State to our questions (and those of other vendors) may cause us to reevaluate our interpretation of requirements, in light of those answers. Microsoft and Offeror therefore reserve the right to add any Exceptions that may result based upon the subsequent answers to the questions. (Submitted: Jan 26, 2016 7:11:42 AM MST) Answer
- Exceptions to the the RFP document should occur during the Q&A period. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 138

5.6.4 Pg. 23 Offeror must provide a statement certifying that it is NIST compliant with the service models it offers.

Will the state please confirm that it requires offers to certify compliance with NIST Special Publication 800-145? (Submitted: Jan 26, 2016 7:11:53 AM MST)
Answer
- Yes. This clarification is made in the final RFP document. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 139
RFP Section 3.4 Offerors may not submit requests for exceptions and/or additions by reference to a vendor's website or URL. URLs provided with a proposal may result in that proposal being rejected as non-responsive.

Exception.

Microsoft respectfully asserts that URLs are necessary and reasonable for clarifying certain terms and conditions which must reasonably be able to evolve over time. For example, we are constantly adding to our IaaS and PaaS offerings, and believe it is reasonable to announce and clarify those updates using a public website. In general, changes are not more restrictive but rather are additive with respect to certain protections offered for the services. (Submitted: Jan 26, 2016 7:12:07 AM MST)
Answer
- Correct. This section is used to ensure that Offerors do not offer blanket exceptions by referring to a URL. URLs may be necessary and reasonable to clarify certain terms and conditions.

However, many evaluators will print off the proposals and may not have access to a URL. So it is recommended that Offerors do not solely rely on URLs. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 140

5.6.5 Pg. 23 Offeror must provide a statement certifying that its service model offering(s) meet or exceed NIST definitions for service models Will the state please confirm that it requires offers to certify compliance with NIST Special Publication 800-145? (Submitted: Jan 26, 2016 7:12:09 AM MST) Answer
- Yes. This clarification is made in the final RFP document. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 141
RFP Section 5.5.4 (M) Offeror must provide a statement certifying that its computer applications and Web sites must be accessible to people with disabilities, and must comply with Participating entity accessibility policies and the Americans with Disability Act, as applicable. Exception Microsoft complies with all laws applicable to it as IT service provider, but not laws applicable to a Purchasing Entityâ€™s own operations. Microsoftâ€™s research indicates that most if not all State accessibility laws (and the Federal ADA) applies to our customers (and not to Microsoft, as service provider), so we respectfully take exception with this clause, as written. Microsoft supports the governmentâ€™s obligation to provide accessible technologies to its citizens with disabilities as required by Section 508 of the Rehabilitation Act of 1973, and its state law counterparts (including applicable California provisions). We encourage our customers (including Purchasing Entities under the Master Agreement and Participating Addenda) to judiciously compare product accessibility performance. The Voluntary Product Accessibility Templates (â€œVPATsâ€ ) for the Microsoft technologies used in providing the online services can be found at Microsoftâ€™s VPAT page. Further information regarding Microsoftâ€™s commitment to accessibility can be found at www.microsoft.com/enable. (Submitted: Jan 26, 2016 7:12:29 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 142
RFP Section 5.5.4 (M) Offeror must provide a statement certifying that its computer applications and Web sites must be accessible to people with disabilities, and must comply with Participating entity accessibility policies and the Americans with Disability Act, as applicable. Exception Microsoft complies with all laws applicable to it as IT service provider, but not laws applicable to a Purchasing Entityâ€™s own operations. Microsoftâ€™s research indicates that most if not all State accessibility laws (and the Federal ADA) applies to our customers (and not to Microsoft, as service provider), so we respectfully take exception with this clause, as written. Microsoft supports the governmentâ€™s obligation to provide accessible technologies to its citizens with disabilities as required by Section 508 of the Rehabilitation Act of 1973, and its state law counterparts (including applicable California provisions). We encourage our customers (including Purchasing Entities under the Master Agreement and Participating Addenda) to judiciously compare product accessibility performance. The Voluntary Product Accessibility Templates (â€œVPATsâ€ ) for the Microsoft State of Utah Bid CH16012
3/22/2016 4:23 PM p. 322
#15..
- 653 -
Entityâ€s own operations. Microsoftâ€s research indicates that most if not all State accessibility laws (and the Federal ADA) applies to our customers (and not to Microsoft, as service provider), so we respectfully take exception with this clause, as written. Microsoft supports the governmentâ€™s obligation to provide accessible technologies to its citizens with disabilities as required by Section 508 of the Rehabilitation Act of 1973, and its state law counterparts (including applicable California provisions). We encourage our customers (including Purchasing Entities under the Master Agreement and Participating Addenda) to judiciously compare product accessibility performance. The Voluntary Product Accessibility Templates (â€œVPATsâ€ ) for the Microsoft technologies used in providing the online services can be found at Microsoftâ€™s VPAT page. Further information regarding Microsoftâ€™s commitment to accessibility can be found at www.microsoft.com/enable. (Submitted: Jan 26, 2016 7:13:30 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 143
RFP Section 5.5.5 (M) Offeror must provide a statement certifying that its applications and content delivered through Web browsers must be accessible using current released versions of multiple browser platforms (such as Internet Explorer, Firefox, Chrome, and Safari) at minimum. Exception and Clarifying Statement For each of the Microsoft cloud services offered by Offeror, to the extent they deliver content through Web browsers, Microsoft generally endeavors to ensure compatibility with the latest versions of the most popular browsers including Internet Explorer, Firefox, Chrome and Safari. As of the date of Offerorâ€™s Proposal, each of these are supported. However, Microsoft respectfully declines to commit to any requirement that would constrain its ability to evolve its services to meet market needs. Over the 10 year term of the Master Agreement, it is likely that browser technology will change, and Microsoft will make decisions (independent of contractual commitments) as to how it will support future versions of these browsers. Microsoft therefore respectfully declines to accept this Section as written. (Submitted: Jan 26, 2016 7:13:58 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 144
RFP Section 5.5.6 (M) Offeror must provide a statement certifying that it shall only use data for purposes defined in the Master Agreement, participating addendum, or related service level agreement. Offeror shall not use the government data or government related data for any other purpose including but not limited to data mining or bids on other government contracts. Offeror and/or its agents shall not resell nor otherwise redistribute information gained from its access to the Purchasing Entity. Clarifying Statement Customer Data will be used only to provide a Purchasing Entity the Online Services including purposes compatible with providing those services. Microsoft will not use Customer Data or derive information from it for any advertising or similar commercial purposes. As between the parties, the Purchasing Entity retains all right, title and interest in and to Customer Data. Microsoft acquires no rights in Customer Data, other than the rights Customer grants to Microsoft to provide the Online Services to Customer. This paragraph does not affect Microsoftâ€™s rights in software or Online Services Microsoft licenses to Purchasing Entity.

Microsoft uses data mining solely for the purposes of providing the cloud services, subject to the abovementioned restrictions. Microsoft will not use data mining for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security or service delivery analysis that is not explicitly authorized. (Submitted: Jan 26, 2016 7:14:14 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 145
Â¶16.b Pg. 12 Specific insurance requirements Please clarify whether the Offeror is required or is not required to add Participating States or Purchasing Entities as an additional insured for Data Breach and Privacy/Cyber Liability including Technology Errors & Omissions and Crime Insurance as outlined in section 16 b. (Submitted: Jan 26, 2016 7:14:24 AM MST)
Answer
- This issue will need to be addressed in negotiations with Participating Entities during the negotiation of the participating addendums. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 146
RFP Section 5.5.8 (M)
Also Attachment B
Also RFP Section 8.13 (E) (5.5.8) Offeror must at a minimum complete, provide, and maintain a completed a Level 1 CSA STAR Registry Self-Assessment and submit a copy under this RFP. Offeror must represent and warrant that it will keep this CSA Star Self-Assessment current on an annual basis and must be provide it to a Purchasing Entity when requested. Offeror must also represent and warrant the accuracy and currency of the State of Utah Bid CH16012
3/22/2016 4:23 PM p. 323
#15..
- 654 -
Also RFP Section 8.13 (E) (5.5.8) Offeror must at a minimum complete, provide, and maintain a completed a Level 1 CSA STAR Registry Self-Assessment and submit a copy under this RFP. Offeror must represent and warrant that it will keep this CSA Star Self-Assessment current on an annual basis and must be provide it to a Purchasing Entity when requested. Offeror must also represent and warrant the accuracy and currency of the information on the completed CSA Star Self-Assessment Form. (8.13) CLOUD SECURITY ALLIANCE QUESTIONNAIRES
Describe your level disclosure of compliance with the Cloud Controls Matrix for each Cloud solutions offered for the three levels below.
a. Level 1 CSA STAR Registry Self-Assessment complete an available through CSA STAR, as required by Mandatory Minimum 4.1.9.
b. Level 2 CSA STAR Registry Assessment Certification
c. Level 2 CSA STAR Registry Attestation Exception and Clarifying Statement Microsoft is on the Board of Directors of the Cloud Security Alliance (CSA). See https://cloudsecurityalliance.org/about/board-of-directors/.

While Microsoft represents that all CCMs were complete to the best of the knowledge of the authors thereof as of the time they were completed, Microsoft respectfully declines to represent and warrant the accuracy of CCMs.

Additionally, for services that do not store or process sensitive Customer Data (e.g. applications such as Office 365 ProPlus, which is merely a delivery mechanism for on-premises software bits), Microsoft does not complete CCMs. (Submitted: Jan 26, 2016 7:14:28 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 147
Â¶16.b.2 and 16.b.4 Pg. 12 Specific insurance requirements Please clarify how Professional Liability as outlined in section 16 b. 4 is different from Technology Errors & Omissions coverage in section 16 b. 2 (Submitted:

Jan 26, 2016 7:14:44 AM MST)
Answer
- Tech E&O policies cover both liability and property loss exposures. Major liability insuring agreements include losses resulting from: (1) technology services, (2) technology products, (3) media content, and (4) network security breaches. Key property insuring agreements provide coverage for extortion threats, crisis management expense, and business interruption.

And some of the value added services may need to be covered by professional liability insurance. (Answered: Jan 28, 2016 9:57:54 AM MST)
Question 148
RFP Section 5.5.9 (M)
Also RFP Section 5.6.1 (M) (5.5.9) Offeror must provide a statement certifying that it agrees to adhere to the services, definitions, and deployment models identified in the Scope of Services, in Attachment D, during the term of the contract.
(5.6.1) Offeror must provide a statement certifying that its Cloud Solutions meet the definitions described in Attachment D Exception and Clarifying Statement
Microsoft is able to provide, for Offerorâ€™s response, statements as to how each Microsoft Online Service meets certain definitions and deployment models shown in Attachment D (and the related Attachment C). However, because of the wide variety of Microsoft Online Services proposed for the Master Agreement, and the diversity of features, functionality and intended uses for each such Online Service, it is not possible for all elements of Attachments D and C to logically apply to each Online Service.

Additionally, over time, Microsoft Online Services will evolve to meet the needs of the marketplace, and the marketplace can be expected to drive evolution and improvements of standards such as NIST 800-53. Microsoft, as provider of these services to many thousands of customers with millions of users, can be expected to provide services that meet its customersâ€™ needs in this regard, but cannot reasonably freeze its design and operation of cloud services based upon any individual customer contract.

Lead State and Participating States may evaluate the Proposal to determine for themselves the suitability of any Microsoft Online Service for their Purchasing Entities. However, Microsoft must respectfully decline to certify that all statements in these attachments apply to all Online Services offered hereunder. (Submitted: Jan 26, 2016 7:14:52 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 149
Â¶19. Ordering Pg. 15 h. Resale. Subject to any explicit permission in a Participating Addendum, Purchasing Entities may not resell goods, software, or Services obtained under this Master Agreement. This limitation does not prohibit: payments by employees of a Purchasing Entity as explicitly permitted under this agreement; sales of goods to the general public as surplus property; and fees associated with inventory transactions with other State of Utah Bid CH16012
3/22/2016 4:23 PM p. 324
#15..
- 655 -
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 149
Â¶19. Ordering Pg. 15 h. Resale. Subject to any explicit permission in a Participating Addendum, Purchasing Entities may not resell goods, software, or Services obtained under this Master Agreement. This limitation does not prohibit: payments by employees of a Purchasing Entity as explicitly permitted under this agreement; sales of goods to the general public as surplus property; and fees associated with inventory transactions with other governmental or nonprofit entities under cooperative agreements and consistent with a Purchasing Entityâ€™s laws and regulations. Any sale or transfer permitted by this subsection must be consistent with license rights granted for use of intellectual property.

Will the state please clarify the bolded language to clarify what the state means (bold added to highlight for questions)? For example, to what type of fees is the state referring; what inventory; and what transactions? (Submitted: Jan 26, 2016 7:15:04 AM MST)
Answer
- Bolding does not show up on questions. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 150
RFP Section 5.5.10 (M) Offeror must provide a statement that its auditing capabilities and reports are consistent with SAS 70 or later versions including, SSAE 16 6/2011, or greater Clarifying Statement For Office 365 Services (exclusive of Yammer), Microsoft Dynamics CRM Online Services, Microsoft Azure Core Services, and Microsoft Intune Online Services (each, as defined in the Microsoft Online Services Terms), each such Microsoft Online Service Each Online Service follows a written data security policy (â€œInformation Security Policyâ€ ) that complies with the control standards and frameworks of SSAE 16 SOC 1 (Type II) and SOC 2 (Type II). Additional standards are listed in the Microsoft Online Services Terms, which also include terms and conditions pursuant to which the audit findings may be provided to Purchasing Entities under non-disclosure agreement. Additionally, please see our response on Section 5.6.4, which pertains to other certifications and compliance with other standards. (Submitted: Jan 26, 2016 7:15:11 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 151
RFP Section 5.5.12 (M) Offeror, as part of its proposal, must provide a sample of its Service Level Agreement (SLA) that contains at a minimum, the terms described in Section 8.13 of the RFP. Exception and Clarifying Statement
Note that the reference to Section 8.13 appears to be a typographic error, as that section does not apply to Service Level Agreements.

Offeror will provide Microsoftâ€™s most recent SLA with its Proposal.

Microsoft respectfully declines to conform its SLA to the terms of any section of the RFP. For clarity, Microsoftâ€™s SLAs are administered in a consistent and in some cases automated way for all its customers, and may therefore not be customized. For any given cloud service, our SLA in effect as of the time a subscription order is first placed is locked and will not change during the term of a subscription order. Upon renewal of a customerâ€™s subscription order, Microsoftâ€™s then-current SLA will supersede the previous SLA. The Purchasing Entityâ€™s renewal of its subscription will constitute its written approval of the then-current (new) SLA.

Microsoftâ€™s historical practice has been to improve its SLAs over time, and we have never before adversely changed any SLA terms.

However, our SLAs may not be customized for any customer, and we must reserve the right to change SLAs over time at our sole discretion, except to the extent one is locked for a subscription as noted above. (Submitted: Jan 26, 2016 7:15:44 AM MST)
Answer
- The typographic error has been corrected. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 152
RFP Section 5.5.13 (M) Offeror must provide a statement certifying that it cannot change the SLA in any manner that adversely affects a Purchasing Entity or degrades the service levels applicable to a Purchasing Entity, without the Purchasing Entityâ€™s written approval. Clarifying Statement Microsoftâ€™s SLAs are administered in a consistent and in some cases automated way for all its customers, and may therefore not be customized. For any given cloud service, our SLA in effect as of the time a subscription order is first placed is locked and will not change during the term of a subscription order. Upon renewal of a customerâ€™s subscription order, Microsoftâ€™s then-current SLA will supersede the previous SLA. The Purchasing Entityâ€™s renewal of its subscription will constitute its written approval of the then-current (new) SLA.

Microsoftâ€™s historical practice has been to improve its SLAs over time, and we have never before adversely changed any SLA terms.

However, our SLAs may not be customized for any customer, and we must reserve the right to change SLAs over time at our sole discretion. (Submitted: Jan 26, 2016 7:16:00 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) State of Utah Bid CH16012
3/22/2016 4:23 PM p. 325
#15..
- 656 -
Microsoftâ€s historical practice has been to improve its SLAs over time, and we have never before adversely changed any SLA terms.

However, our SLAs may not be customized for any customer, and we must reserve the right to change SLAs over time at our sole discretion. (Submitted: Jan 26, 2016 7:16:00 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 153
RFP Section 5.5.12 (M) Offeror, as part of its proposal, must provide a sample of its Service Level Agreement (SLA) that contains at a minimum, the terms described in Section 8.13 of the RFP. Exception and Clarifying Statement
Note that the reference to Section 8.13 appears to be a typographic error, as that section does not apply to Service Level Agreements.

Offeror will provide Microsoftâ€™s most recent SLA with its Proposal.

Microsoftâ€™s historical practice has been to improve its SLAs over time, and we have never before adversely changed any SLA terms.

However, our SLAs may not be customized for any customer, and we must reserve the right to change SLAs over time at our sole discretion, except to the extent one is locked for a subscription as noted above. (Submitted: Jan 26, 2016 7:17:26 AM MST)
Answer
- The typographic error has been corrected. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 154
RFP Section 5.5.13 (M) Offeror must provide a statement certifying that it cannot change the SLA in any manner that adversely affects a Purchasing Entity or degrades the service levels applicable to a Purchasing Entity, without the Purchasing Entityâ€™s written approval. Clarifying Statement Microsoftâ€™s SLAs are administered in a consistent and in some cases automated way for all its customers, and may therefore not be customized. For any given cloud service, our SLA in effect as of the time a subscription order is first placed is locked and will not change during the term of a subscription order. Upon renewal of a customerâ€™s subscription order, Microsoftâ€™s then-current SLA will supersede the previous SLA. The Purchasing Entityâ€™s renewal of its subscription will constitute its written approval of the then-current (new) SLA.

Microsoftâ€™s historical practice has been to improve its SLAs over time, and we have never before adversely changed any SLA terms.

However, our SLAs may not be customized for any customer, and we must reserve the right to change SLAs over time at our sole discretion. (Submitted: Jan 26, 2016 7:18:35 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 155
Part 1:

Offeror must provide a statement acknowledging that no click-through, or other end user terms and conditions or agreements required by the Contract Vendor (â€œAdditional Termsâ€ ) provided with any Services hereunder shall be binding on Participating Entities or Purchasing Entities, even if use of such Services requires an affirmative â€œacceptanceâ€ of those Additional Terms before access is permitted, unless agree to in the Master Agreement Terms and Conditions or in a Participating Addendum.

Exception and Clarifying Statement.

Contractual commitment: For the Microsoft Online Services sold and licensed to Purchasing Entities hereunder, no click-through licensing terms presented to end users or administrators, as they pertain to the delivery, operation or use of such services, shall be binding. For clarity, to the extent that certain services may present terms of use for a web portal used to administer and configure the Online Services, or to download software in conjunction with the Online Services, such terms of use shall be binding, to the extent that there are no equivalent terms and conditions in the Master Agreement which pertain to the use of such web portals. (Submitted: Jan 26, 2016 7:19:47 AM MST)
Answer
- All terms and conditions that an Offeror believes will apply must be disclosed and provided under the Master Agreement. (Answered: Jan 28, 2016 9:57:54 AM MST)
Question 156
Part 2
Other than the foregoing, Microsoft respectfully takes exception to the additional requirement in this section 5.5.14 State of Utah Bid CH16012
3/22/2016 4:23 PM p. 326
#15..
- 657 -
Answer
- All terms and conditions that an Offeror believes will apply must be disclosed and provided under the Master Agreement. (Answered: Jan 28, 2016 9:57:54 AM MST)
Question 156
Part 2
Other than the foregoing, Microsoft respectfully takes exception to the additional requirement in this section 5.5.14 that would prevent any other form of â€œAdditional Termsâ€ from applying. Specifically:
(1) Because Microsoft is constantly adding to its list of Azure (and some other) Online Services, Microsoft must rely on URL-published lists of these Online Services in order to update its customers about such things as (i) whether they are included in Microsoftâ€™s Government Community Cloud; (ii) whether they are subject to particular certifications; etc.
(2) Microsoft publishes and regularly updates its Microsoft Online Services Terms (OST), which are incorporated into the terms and conditions of the Master Agreement applicable to Purchasing Entities and include (but are not limited to) both licensing and security/privacy terms and conditions, both generally and on a product-specific basis. Offeror has attached with its Proposal a copy of the latest version of the OST. Microsoft endeavors to improve the terms and conditions of the OST over time, and also must reasonably be able to update its terms in order to accommodate new products and changes to existing technology.

As such, Offeror and its subcontractor Microsoft will be willing to stipulate the following:

A. The mutually-agreed terms of the Master Agreement and Participating Addenda will take precedence over the OST, in the event of a conflict between them.

B. With respect to any individual subscription for an individual Online Service, changes to the OST during the term of the subscription shall not apply unless a Purchasing Entity elects to apply them. At the onset of a subsequent renewal subscription term, the then-current OST shall apply. (Submitted: Jan 26, 2016 7:24:09 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 9:57:54 AM MST) Question 157
RFP Section 5.6.2 (M) Offeror must provide a statement certifying that its Service Level Agreement must define the performance and other operating parameters within which the infrastructure must operate to meet IT System and Purchasing Entityâ€™s requirements. Exception
Microsoft respectfully takes exception to this requirement as unreasonable. It is impossible for the provider of a standardized multi-tenant cloud service, provided uniformly to thousands of customers and millions of users, to design that service to meet each and every one of its customerâ€™s individual requirements. Microsoft transparently provides information about its Online Services to all customers so that they may judge for themselves whether the Online Services meet their needs. (Submitted: Jan 26, 2016 7:24:32 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 158
Due to the size of the following question the reference info will be in this question and the question in the following entry:

RFP Section 5.6.4 (M)
Also RFP Section 5.6.5 (M) (identical)
Also RFP Section 8.6.1 (E)
Also RFP Section 8.6.2 (E)
Also RFP Section 8.6.6 (E)
Offeror must provide a statement certifying that it is NIST compliant with the service models it offers.

Specify your commitment to your commitment to comply with NIST, and any other relevant industry standards, as it relates to the Scope of Services described in this RFP, including supporting the different types of data that you may receive. You should include detailed response on how you plan to maintain security certifications.

List all government or standards organization security certifications you currently hold that apply specifically to the hosted environment described in your firmâ€™s RFP response, as well as those in process at time of response.

Specifically include HIPAA, FERPA, CJIS Security Policy, PCI Data Security Standards (DSS), IRS Publication 1075, FISMA, NIST 800-53, NIST SP 800-171, and FIPS 200 if they apply.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 327
#15..
- 658 -
Specify your commitment to your commitment to comply with NIST, and any other relevant industry standards, as it relates to the Scope of Services described in this RFP, including supporting the different types of data that you may receive. You should include detailed response on how you plan to maintain security certifications.

Specifically include HIPAA, FERPA, CJIS Security Policy, PCI Data Security Standards (DSS), IRS Publication 1075, FISMA, NIST 800-53, NIST SP 800-171, and FIPS 200 if they apply.

Provide a detailed list of the third-party attestations, reports, security credentials (e.g., FedRamp), and certifications relating to data security, integrity, and other controls. (Submitted: Jan 26, 2016 7:27:21 AM MST) Answer
- I do not see a question in this question. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 159
part 1:

Microsoft will agree that, during the term of a Purchasing Entityâ€™s subscription for its â€œGovernment Community Cloud Servicesâ€ (as defined in Microsoftâ€™s terms and conditions), those services will be operated in accordance with a written data security policy and control framework that is consistent with the requirements of NIST 800-53 Revision 4, or successor standards and guidelines (if any), established to support Federal Risk and Authorization Management Program (FedRAMP) accreditation at a Moderate Impact level.

Microsoft intends for Government Community Cloud Services to support FedRAMP Authority to Operate (ATO), and Microsoft will use commercially reasonable efforts to obtain an ATO from a Federal agency, and to maintain such ATO through continuous monitoring processes and by conducting regular FedRAMP audits.

Also see the Microsoft Trust Center at https://www.microsoft.com/en-us/TrustCenter/default.aspx and click on the applicable link for information about Microsoftâ€™s compliance and adherence to other standards, such as CJIS, IRS 1075, HIPAA, FERPA, ISO/IEC 27001 and (Submitted: Jan 26, 2016 7:29:35 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 160
part 2:
27018, SOC1 and 2, and others. Also, please refer to our Exception and Clarifying Statements for Attachment A, Section 17, below in this document. Please note that some of these standards apply only to certain services (e.g.

CJIS applies only our Government Community Cloud services) and that some of them require special Amendments and/or Agreements (e.g. CJIS requires that a Stateâ€™s CJIS Systems Agency must execute a special agreement with Microsoft, before Microsoft will provide an FBI CJIS Addendum for use in each such state).

Microsoft welcomes the opportunity to discuss this in more detail during negotiation.

Additionally, for the commercial and education versions of Office 365 Services (which are not Government Community Cloud Services), Microsoft Dynamics CRM Online Services, Microsoft Azure Core Services, and Microsoft Intune Online Services (each, as defined in the Microsoft Online Services Terms), each such Microsoft Online Service Each Online Service follows a written data security policy (â€œInformation Security Policyâ€ ) that complies with the control standards and frameworks shown in the table below. (Submitted: Jan 26, 2016 7:30:13 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 161
Part I: Question will be part 2:

RFP Section 5.6.6 (M)
Also RFP Section 8.8.2, subsections c and d (E) Offeror must provide a statement certifying that it on request you can isolate that data to servers and data centers residing entirely in the United States of America or its territories.

Explain and specify methodologies for the following backup and restore services:
c. Digital location of backup storage (secondary storage, tape, etc.) d. Alternate data center strategies for primary data centers within the continental United States. (Submitted: Jan 26, 2016 7:53:32 AM MST)
Answer
- I do not see a question in this question. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 162
Exception and Clarifying Statement
For its Government Community Cloud Services (as defined in Microsoftâ€™s service terms and conditions), or â€œGCC,â€ Customer Content is stored at rest in the United States. In the cases of the GCC versions of Exchange Online, SharePoint Online, Skype for Business, and Dynamics CRM Online, the Customer Content is stored in encrypted format, whereas in the GCC version of Azure Core Services, customers are given the option to encrypt non-public Customer Content.

For the non-GCC (public) versions of the equivalent services, as well as for Microsoft Intune Online Services, State of Utah Bid CH16012
3/22/2016 4:23 PM p. 328
#15..
- 659 -
Question 162
Exception and Clarifying Statement
For its Government Community Cloud Services (as defined in Microsoftâ€™s service terms and conditions), or â€œGCC,â€ Customer Content is stored at rest in the United States. In the cases of the GCC versions of Exchange Online, SharePoint Online, Skype for Business, and Dynamics CRM Online, the Customer Content is stored in encrypted format, whereas in the GCC version of Azure Core Services, customers are given the option to encrypt non-public Customer Content.

For the non-GCC (public) versions of the equivalent services, as well as for Microsoft Intune Online Services, certain types of Customer Content are stored at rest in the United States, if set up by the users in the United States. The terms and conditions governing where Customer Data will be stored may be found in the Microsoft Online Services Terms. Finally, for the non-GCC version of Azure Core Services, customers are given the choice of which of Microsoftâ€™s worldwide data centers to store and/or process data in.

For purposes of the above, â€œCustomer Contentâ€ means the subset of Customer Data created by users.

For Office 365 Services, Customer Content shall at least include Exchange Online mailbox content (e-mail body, calendar entries, and the content of e-mail attachments), SharePoint Online site content and the files stored within that site, and Skype for Business Online archived conversations. For Microsoft Dynamics CRM Online Services, Customer Content shall be the entities of Customer Data managed by the Microsoft Dynamics CRM Online Services (Submitted: Jan 26, 2016 7:55:58 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 163
RFP Section 5.6.7 (M) Offeror must provide a statement certifying that it will comply with all applicable laws and related to data privacy and security, which will be defined in the relevant Participating Addendum and/or Service Level Agreement. Exception
Microsoft will comply with all applicable laws (including but not limited to privacy and security related laws) applicable to IT service providers. For clarity, however, Microsoft does not agree to comply with laws written to apply solely to governments and their government functions (or to companies and their industry functions). For example, some laws pertaining to notification of security incidents apply to our government customers (not to IT Service Providers), so Microsoft does not agree to comply with those (but we believe our contractual commitments for Security Incident reporting are sufficient to help customers comply with their own laws).

Additionally, Microsoft respectfully declines to agree in advance to comply with laws to be listed in Participating Addenda, as Microsoft cannot reasonably be expected to review (and determine applicability of) all the possible laws that Participating States may list on those in the future. Microsoft sincerely hopes that its general contractual commitment to comply with all laws applicable to IT Service Providers will satisfy all Participating States. (Submitted: Jan 26, 2016 7:56:24 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 164
RFP Section 5.6.14 (M)
Also RFP Section 8.18 (E) (5.6.14) If applicable, Offeror must provide a statement certifying that its applicationhosting environments also support a user test/staging environment that is identical to production. (8.18) Describe your testing and training periods that your offer for your service offerings. Clarifying Statement For RFP Section 5.6.14, Microsoft asserts the following:
a. Microsoft currently, as of the date of the Proposal, has a mechanism by which 30-day Trial subscriptions may be ordered for some, but not all, of the cloud services offered hereunder. Microsoft will provide additional information about this upon request of Lead State, Participating States, or any Purchasing Entity. b. It is possible for any Purchasing Entity to purchase a separate subscription for the purpose of establishing a second environment for test and/or staging purposes. Such separate Subscription would be at an additional cost, and additional contract paperwork may be required. (Submitted: Jan 26, 2016 7:56:57 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 165

TECHNICAL REQUIREMENTS
<Long section, not printed here â€“ these notes and disclaimers apply to the Section as a whole, although we will also address individual subsections, below.> Clarifying Statement.

The Microsoft Online Services in this Proposal provide highly-scalable and configurable solutions to address each customerâ€™s stated business needs in a cost-effective manner. These Online Services are multi-tenant â€œcloudâ€ solutions hosted by Microsoft, operating on standardized terms, protocols and procedures.

Microsoft is not able to customize the Online Services or their operational protocols for any individual government customer.

As with any standardized cloud service, Microsoft expects to evolve and improve the features and functions of these Online Services. For that reason, Microsoft reserves the right to update and change features and functionality described in this response during the term of the agreement between parties.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 329
#15..
- 660 -
The Microsoft Online Services in this Proposal provide highlyscalable and configurable solutions to address each customerâ€™s stated business needs in a cost-effective manner. These Online Services are multi-tenant â€œcloudâ€ solutions hosted by Microsoft, operating on standardized terms, protocols and procedures.

Microsoft is not able to customize the Online Services or their operational protocols for any individual government customer.

The features and functionality listed in the Proposal represent the Microsoft Online Services as of our response date, but neither Offeror nor Microsoft can guarantee that these features and functions will not change over time.

Microsoft generally provides advance notice to its customers of major changes, but might not in all cases notify regarding minor changes. It is Microsoftâ€™s goal to improve the service over time. (Submitted: Jan 26, 2016 7:57:44

AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 166
RFP Section 8.4.1 (3rd bullet point) (E) Service Level Agreement (SLA). Please note that the terms and conditions of this RFP and all exhibits take precedence over any conflicting terms and conditions in the SLA.

Exception
Microsoft respectfully takes exception to this requirement. Microsoftâ€™s SLA applies to standardized cloud services that cannot be customized for any one customer, as they are delivered uniformly to all customers. The process by which Microsoft administers its SLA is also standardized, relying upon both automated processes and standard operating procedures. As such, Microsoft cannot reasonably be expected to conform to any of its customersâ€™ individual SLAs. (Submitted: Jan 26, 2016 7:58:07 AM MST) Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 167
Certify that all traffic to and from the hosting environment can and will be guaranteed to stay within the United States. Exception and Clarifying Statement
Microsoft respectfully takes exception to this requirement, as it is impossible to restrict data flowing through the public Internet (through which traffic to and from the hosting environment passes) to the United States. This is the case for all internet-based cloud services from all vendors.

For an additional fee, Microsoft offers optional services such as private IPSec VPN or ExpressRoute to provide a direct connection between a Purchasing Entityâ€™s network equipment and Microsoftâ€™s Online Services offered hereunder. The private IPSec VPN service provides a protected connection over the internet between the Purchasing Entityâ€™s network and Microsoftâ€™s Online Services. ExpressRoute provides a direct network connection between the Purchasing Entityâ€™s network and Microsoftâ€™s Online Services bypassing the Internet. (Submitted: Jan 26, 2016 7:58:31 AM MST)
Answer
- Please provide this information and any other information that an Offeror believes is necessary to meet this requirement in its proposal. (Answered: Jan 28, 2016 10:25:20 AM MST) Question 168
RFP Section 8.10 (E) Describe whether your sample Service Level Agreement is negotiable. Clarifying Statement
Microsoftâ€™s Service Level Agreement is not negotiable, as it pertains to standardized multitenant cloud services, uniformly delivered to many thousands of customers and millions of users, and relies upon automated processes and standard operating procedures. (Submitted: Jan 26, 2016 7:59:00 AM MST) Answer
- Responses to the RFP document need to be provided in an Offeror's proposal, not during the Question and Answer period. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 169
RFP Section 8.16 Ability to provide anti-virus protection, for data stores. Clarifying Statement For Office 365 Services, Microsoft Azure Core Services, Microsoft Dynamics CRM Online Services, and Microsoft Intune Online Services (as each is defined in the Microsoft Online Services Terms), Microsoft will implement and maintain all appropriate administrative, physical, technical and procedural safeguards in accordance with the terms and conditions of the Microsoft Online Services Terms, at all times during the term of the Master Agreement, to secure Customer Data from Security Incident, protect Customer Data and the applicable Online Services from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt a customerâ€™s access to its Customer Data.

Additionally, see the section of Microsoftâ€™s Service Level Agreement pertaining to anti-virus. (Submitted: Jan 26, 2016 7:59:36 AM MST)
Answer
- Responses to the RFP document need to be provided in an Offeror's proposal, not during the Question and Answer period. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 170
RFP Section 8.16 Ability to provide anti-virus protection, for data stores. Clarifying Statement For Office 365 Services, Microsoft Azure Core Services, Microsoft Dynamics CRM Online Services, and Microsoft Intune Online Services (as each is defined in the Microsoft Online Services Terms), Microsoft will implement and maintain all appropriate administrative, physical, technical and procedural safeguards in accordance with the terms and conditions of the Microsoft Online Services Terms, at all times during the term of the Master Agreement, to secure Customer Data from Security Incident, protect Customer Data and the applicable Online Services from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt a customerâ€™s access to its Customer Data.

Additionally, see the section of Microsoftâ€™s Service Level Agreement pertaining to anti-virus. (Submitted: Jan 26, 2016 8:03:29 AM MST)
Answer
- Responses to the RFP document need to be provided in an Offeror's proposal, not during the Question and Answer period.

Any response/question will not be considered part of an Offeror's response if it is posted on Bidsync. (Answered:

Jan 26, 2016 8:18:40 AM MST)
Question 171
RFP Section 8.23 In responding to this section, please review the Cyber Insurance requirements in Attachment 5 RFP Section 8.23 In responding to this section, please review the Cyber Insurance requirements in Attachment A: Master Agreement Terms and Conditions. Describe if you have cyber insurance; and if so what is the coverage and what levels of protection does it provide to Purchasing Entities. Please see our Exception and Clarifying Statement, below, for Attachment A, Section 16. (Submitted: Jan 26, 2016 8:03:52 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:18:40 AM MST)
Question 172
Attachment A, Section 2, definition of â€œConfidential Informationâ€ Confidential Information means any and all information of any form that is marked as confidential or would by its nature be deemed confidential obtained by Contractor or its employees or agents in the performance of this Master Agreement, including, but not necessarily limited to (1) any Purchasing Entityâ€™s records, (2) personnel records, and (3) information concerning individuals, is confidential information of Purchasing Entity. Exception Microsoft requests the following alternative definition, which we believe is no less protective and is more appropriate for a cloud services contract, to the extent it contemplates Customer Data. We have merged much of the RFPâ€™s definition into ours.
â€œConfidential Informationâ€ is non-public information that is designated â€œconfidentialâ€ or that a reasonable person should understand to be confidential, including (1) Customer Data; (2) any Purchasing Entityâ€™s records, (3) personnel records, and (4) information concerning individuals. Confidential Information does not include information that (a) becomes publicly available without a breach of this agreement, (b) was lawfully known or received by the receiving party without an obligation to keep it confidential, (c) is independently developed, or (d) is a comment or suggestion one party volunteers about the otherâ€™s business, products or services.â€ (Submitted: Jan 26, 2016 8:04:31 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:18:40 AM MST)
Question 173
Data means all information, whether in oral or written (including electronic) form, created by or in any way originating with a Participating Entity or Purchasing Entity, and all information that is the output of any computer processing, or other electronic manipulation, of any information that was created by or in any way originating with a Participating Entity or Purchasing Entity, in the course of using and configuring the Services provided under this Agreement.

Exception
Microsoft respectfully request to use its definition (see below). Issues with the RFPâ€™s definition are as follows:
1) The RFPâ€™s definition conflates electronic data with oral and other written data. Microsoft necessarily divides these into separate categories: (a) data stored and processed by our Online Services, which Microsoft calls â€œCustomer Dataâ€ in its documents and is subject to the protections of Microsoftâ€™ robust Online Services Terms; vs. (b) other types of data exchanged between the parties which, if that data meets the definition of Confidential Information, will be protected solely by the confidentiality terms. To provide just one example of relevance, Customer Data stored on our servers used to provide our Government Community Cloud Services will be subjected to NIST 800-53 controls necessary to meet the FedRAMP Moderate specification, whereas oral data exchanged between the parties will not be subjected to those controls (although, if confidential, will be treated as such)
(SbittdJ262016 80933 AM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 331
#15..
- 662 -
these into separate categories: (a) data stored and processed by our Online Services, which Microsoft calls â€œCustomer Dataâ€ in its documents and is subject to the protections of Microsoftâ€™ robust Online Services Terms; vs. (b) other types of data exchanged between the parties which, if that data meets the definition of Confidential Information, will be protected solely by the confidentiality terms. To provide just one example of relevance, Customer Data stored on our servers used to provide our Government Community Cloud Services will be subjected to NIST 800-53 controls necessary to meet the FedRAMP Moderate specification, whereas oral data exchanged between the parties will not be subjected to those controls (although, if confidential, will be treated as such). (Submitted: Jan 26, 2016 8:09:33 AM MST)
Answer
- The definition of "Data" is contained in the Master Agreement Terms and Conditions. As such, an Offeror should not be taking exception to the terms and conditions during the the questions and answer period.

As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:18:40 AM MST)
Question 174
Data means all information, whether in oral or written (including electronic) form, created by or in any way originating with a Participating Entity or Purchasing Entity, and all information that is the output of any computer processing, or other electronic manipulation, of any information that was created by or in any way originating with a Participating Entity or Purchasing Entity, in the course of using and configuring the Services provided under this Agreement.

Question 2:
) The RFPâ€™s definition would treat metadata (e.g. data generated by the systems of an Online Services based upon the analysis or categorization of Customer Data) equally with the data input by Purchasing Entities. Metadata will be used by Microsoft only for the provision of the Online Services, including but not limited to spam and virus filtering, data loss prevention, spillage support, transaction logs, temp files, and memory buffers.. Neither Customer Data nor metadata will be used by Microsoft for purposes of data mining to target advertisements to users. However, unlike Customer Data, Microsoft retains ownership of metadata and customers may not delete or extract it.

Proposed alternative language:
â€œCustomer Dataâ€ means all data, including all text, sound, software, or image files that are provided to Microsoft by, or on behalf of, an Enrolled Affiliate through its use of the Online Services. All references to â€œDataâ€ in the Master Agreement shall be deemed to mean customer data. (Submitted: Jan 26, 2016 8:10:21

AM MST)
Answer
- The definition of "Data" is contained in the Master Agreement Terms and Conditions. As such, an Offeror should not be taking exception to the terms and conditions during the the questions and answer period.

As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:18:40 AM MST)
Question 175
Attachment A, Section 2, Definitions of â€œData Breachâ€ and â€œSecurity Incidentâ€ Data Breach means any actual or reasonably suspected non-authorized access to or acquisition of computerized Non-Public Data or Personal Data that compromises the security, confidentiality, or integrity of the Non-Public Data or Personal Data, or the ability of Purchasing Entity to access the Non-Public Data or Personal Data.

Security Incident means the possible or actual unauthorized access to a Purchasing Entityâ€™s Non-Public Data and Personal Data the Contractor believes could reasonably result in the use, disclosure or theft of a Purchasing Entityâ€™s Non-Public Data within the possession or control of the Contractor. A Security Incident also includes a major security breach to the Contractorâ€™s system, regardless if Contractor is aware of unauthorized access to a Purchasing Entityâ€™s Non-Public Data. A Security Incident may or may not turn into a Data Breach.

Suggested alternative language:
â€œSecurity Incidentâ€ means any unlawful access, use, theft or destruction to any Customer Data stored on Microsoftâ€™s equipment or in Microsoftâ€™s facilities, or unauthorized access to such equipment or facilities resulting in use, theft, loss, disclosure, alteration or destruction of Customer Data. All references to â€œData Breachâ€ in the Master Agreement shall be deemed to mean Security Incident (Submitted: Jan 26, 2016 8:24:43 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 176
Because of the maximum, this question will be in two parts. The first is the language and the second is question:

Part I:

Attachment A, Section 2, Definitions of â€œData Breachâ€ and â€œSecurity Incidentâ€ Data Breach means any actual or reasonably suspected non-authorized access to or acquisition of computerized Non-Public Data or State of Utah Bid CH16012
3/22/2016 4:23 PM p. 332
#15..
- 663 -
answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 176
Because of the maximum, this question will be in two parts. The first is the language and the second is question:

Part I:

Attachment A, Section 2, Definitions of â€œData Breachâ€ and â€œSecurity Incidentâ€ Data Breach means any actual or reasonably suspected non-authorized access to or acquisition of computerized Non-Public Data or Personal Data that compromises the security, confidentiality, or integrity of the Non-Public Data or Personal Data, or the ability of Purchasing Entity to access the Non-Public Data or Personal Data.

Jan 26, 2016 8:25:51 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 177
Part 2
Exception.

Microsoft respectfully takes exception with both these definitions, and asks that both of them be consolidated into a single defined term â€œSecurity Incidentâ€ using the alternative language proposed by Microsoft below, for the following reasons:
1) Microsoft maintains standardized multitenant Online Services that involve standardized processes, including but not limited to the processes involved with notification and mitigation of Security Incidents. Microsoft cannot feasibly customize its Security Incident processes.
2) Microsoftâ€™s processes do not recognize any distinction between â€œData Breachâ€ and â€œSecurity Incident.â€ Microsoft defines â€œSecurity Incidentâ€ (below) to describe precisely what sort of event will be reported to customers pursuant to Microsoftâ€™s standard processes. 3) Neither Microsoft, nor any other provider of similar multitenant cloud services we are aware of, report suspected Security Incidents. We constantly monitor for events that raise suspicions, and investigate those accordingly. But the number of suspected incidents we investigate is large. It is only when we confirm that a Security Incident has actually happened that we report it.
4) Neither Microsoftâ€™s processes, nor those of our similarly-situated competitors providing standardized multitenant cloud services, include reporting of events that do not result in loss, disclosure or alteration of Customer Data. (Submitted: Jan 26, 2016 8:26:25 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 178
Because of space allowed, first we are listing the RFP language. Part 2 will be the exceptions/clarifications:

Attachment A, Section 2, definition of â€œProtected Health Informationâ€ Protected Health Information (PHI) means individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by the Family Educational Rights and Privacy Act (FERPA), as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer. PHI may also include information that is a subset of health information, including demographic information collected from an individual, and (1) is created or received by a health care provider, health plan, employer or health care clearinghouse; and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (a) that identifies the individual; or (b) with respect to which there is a reasonable basis to believe the information can be used to identify the individual. (Submitted: Jan 26, 2016 8:27:53 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 179
Part 2:

Exception:

Microsoft does not object to defining PHI as is defined in statute. However, to the extent that the definition in statute may change, the RFP (by fixing the definition to the current one) would create conflict if, in the future, the definition in statute is updated.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 333
#15..
- 664 -
answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 179
Part 2:

Exception:

Additionally, for purposes of Microsoftâ€™s role as Business Associate with respect to PHI processed in our Online Services, we respectfully request to clarify that only that which is stored and processed by those Online Services will apply.

We therefore respectfully request the following alternative language be used:
â€œProtected Health Informationâ€ shall have the same meaning as the term â€œprotected health informationâ€ in 45 CFR Â§ 160.103 of HIPAA, provided that it is limited to such protected health information that is received by Microsoft from, or created, received, maintained, or transmitted by Microsoft on behalf of, Customer. (Submitted: Jan 26, 2016 8:28:32 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 180
Attachment A, Section 2, definition of â€œService Level Agreementâ€ Service Level Agreement (SLA) means a written agreement between both the Purchasing Entity and the Contractor that is subject to the terms and conditions in this Master Agreement and relevant Participating Addendum unless otherwise expressly agreed in writing between the Purchasing Entity and the Contractor. SLAs should include: (1) the technical service level performance promises, (i.e. metrics for performance and intervals for measure), (2) description of service quality, (3) identification of roles and responsibilities, (4) remedies, such as credits, and (5) an explanation of how remedies or credits are calculated and issued. Exception.

Microsoftâ€™s SLA reflects standardized and automated processes by which service credits are provided in the event that certain performance standards are not adhered to, as stated in the SLA document. As stated in our response to Section 8.10 of the RFP, Microsoftâ€™s SLA is not negotiable, to the extent that Microsoft must reasonably administer our SLA in a uniform manner for all its customers.

Microsoft therefore respectfully requests to use the following alternative language:
â€œService Level Agreementâ€ (SLA) means the document which specifies the standards to which Microsoft agrees to adhere and by which it measures the level of service for an Online Service. Microsoftâ€™s current and archived prior version SLAs are available at the Microsoft Volume Licensing Site (www.microsoft.com/contracts of a successor site). With respect to any Microsoft Online Service ordered under the Maser Agreement, the most current SLA available at the onset of a subscription License term shall apply to that Online Service for the duration of that subscription License Term, after which (for any subsequent renewal subscription License term) it will be superseded by the version current at the time of renewal. (Submitted: Jan 26, 2016 8:28:58 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 181
Because of the entry limit part 1 is the RFP language and our second question will be the exception question; Attachment A, Section 7 Termination: Unless otherwise stated, this Master Agreement may be terminated by either party upon 60 days written notice prior to the effective date of the termination. Further, any Participating Entity may terminate its participation upon 30 days written notice, unless otherwise limited or stated in the Participating Addendum. Termination may be in whole or in part. Any termination under this provision shall not affect the rights and obligations attending orders outstanding at the time of termination, including any right of any Purchasing Entity to indemnification by the Contractor, rights of payment for Services delivered and accepted, data ownership, Contractor obligations regarding Purchasing Entity Data, rights attending default in performance an applicable Service Level of Agreement in association with any Order, Contractor obligations under Termination and Suspension of Service, and any responsibilities arising out of a Security Incident or Data Breach. Termination of the Master Agreement due to Contractor default may be immediate. (Submitted: Jan 26, 2016 8:30:17 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 182
Part 2:

Exception.

Microsoft respectfully requests a cure period before any termination for default becomes effective, provided that a breach is curable. To that end, we respectfully request to modify that last sentence accordingly. In addition, we have found and corrected a few typographical errors in the original language.

State of Utah Bid CH16012
3/22/2016 4:23 PM p. 334
#15..
- 665 -
answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 182
Part 2:

Exception.

Proposed revision:

Termination: Unless otherwise stated, this Master Agreement may be terminated by either party upon 60 days written notice prior to the effective date of the termination. Further, any Participating Entity may terminate its participation upon 30 days written notice, unless otherwise limited or stated in the Participating Addendum.

Termination may be in whole or in part. Any termination under this provision shall not affect the rights and obligations attending orders outstanding at the time of termination, including any right of any Purchasing Entity to indemnification by the Contractor, rights of payment for Services delivered and accepted, data ownership, Contractor obligations regarding Purchasing Entity Data, rights attending default in performance of an applicable Service Level Agreement in association with any Order, Contractor obligations under Termination and Suspension of Service, and any responsibilities arising out of a Security Incident or Data Breach. Termination of the Master Agreement due to Contractor default may be immediate if defaults cannot be reasonably cured as allowed per Default and Remedies terms. (Submitted: Jan 26, 2016 8:30:47 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 183
This question will be spread out over 4 questions because of the size:

Part 1 of RFP Language
Subsection b.) Non-Disclosure. Contractor shall hold Confidential Information in confidence, using at least the industry standard of confidentiality, and shall not copy, reproduce, sell, assign, license, market, transfer or otherwise dispose of, give, or disclose Confidential Information to third parties or use Confidential Information for any purposes whatsoever other than what is necessary to the performance of Orders placed under this Master Agreement. Contractor shall advise each of its employees and agents of their obligations to keep Confidential Information confidential. Contractor shall use commercially reasonable efforts to assist Purchasing Entity in identifying and preventing any unauthorized use or disclosure of any Confidential Information. Without limiting the generality of the foregoing, Contractor shall advise Purchasing Entity, applicable Participating Entity, (Submitted: Jan 26, 2016 8:32:48 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 184
Part 2 RFP language:
and the Lead State immediately if Contractor learns or has reason to believe that any person who has had access to Confidential Information has violated or intends to violate the terms of this Master Agreement, and Contractor shall at its expense cooperate with Purchasing Entity in seeking injunctive or other equitable relief in the name of Purchasing Entity or Contractor against any such person. Except as directed by Purchasing Entity, Contractor will not at any time during or after the term of this Master Agreement disclose, directly or indirectly, any Confidential Information to any person, except in accordance with this Master Agreement, and that upon termination of this Master Agreement or at Purchasing Entityâ€™s request, Contractor shall turn over to Purchasing Entity all documents, papers, and other matter in Contractor's possession that embody Confidential Information. (Submitted:

Jan 26, 2016 8:33:25 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 185
exceptions from previous 2 'questions':

Exception
First, in Subsection b., Microsoft respectfully request to strike the sentence â€œContractor shall use commercially reasonable efforts to assist Purchasing Entity in identifying and preventing any unauthorized use or disclosure of any Confidential Information.â€œ This is unreasonable to expect either Offeror or its subcontractor and service provider, Microsoft, to do, to the extent that how any end user may or may not use a service is beyond the scope of control of any outside party. Having said this, some of Microsoftâ€™s Online Services Licenses include Data Loss Prevention (DLP) technology, which may be able to assist Purchasing Entities in this regard. Additional technical and licensing information about DLP is available upon request.

Next, in the following sentence (beginning with â€œWithout limiting the generalityâ€¦â€ , Microsoft respectfully State of Utah Bid CH16012
3/22/2016 4:23 PM p. 335
#15..
- 666 -
First, in Subsection b., Microsoft respectfully request to strike the sentence â€œContractor shall use commercially reasonable efforts to assist Purchasing Entity in identifying and preventing any unauthorized use or disclosure of any Confidential Information.â€œ This is unreasonable to expect either Offeror or its subcontractor and service provider, Microsoft, to do, to the extent that how any end user may or may not use a service is beyond the scope of control of any outside party. Having said this, some of Microsoftâ€™s Online Services Licenses include Data Loss Prevention (DLP) technology, which may be able to assist Purchasing Entities in this regard. Additional technical and licensing information about DLP is available upon request.

Next, in the following sentence (beginning with â€œWithout limiting the generalityâ€¦â€ , Microsoft respectfully requests to change the word â€œpersonâ€ to â€œof Contractorâ€™s Employees,â€ to the extent that Contractor only has visibility to and control over the actions of its own employees.

Finally, because Customer Data is considered Confidential Information, and because Microsoft reasonably must be able to limit its liability in the event of a Security Incident. Except in the case of gross negligence or willful misconduct, Microsoft reasonably limits its liability with respect to Security Incidents (see our next Exceptions, in which we request a Limitation of Liability section, for additional details). Microsoft therefore respectfully requests to add the following subsection e to Section 8, as follows:
e. Notwithstanding the foregoing, damages attributable to Security Incidents shall be subject to the Section of the Master Agreement titled â€œLimitation of Liability.â€ (Submitted: Jan 26, 2016 8:34:11 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 186
Part 1:

Microsoft respectfully requests that the following additional Section, titled â€œLimitation of Liability,â€ be inserted into Attachment A as Section 43, and that the existing Section 43, titled â€œEntire Agreement,â€ be renumbered as Section 44.

Note that â€œAffiliateâ€ will be defined as:
ïƒ˜ For a Purchasing Entity, any entity eligible to purchase under the Master Agreement or a Participating Addendum to which a Purchasing Entity sublicenses the use of the Online Service. ïƒ˜ For Microsoft, any company that Microsoft owns, that owns Microsoft, or is under common ownership with Microsoft.

Proposed language:

43. Limitation of Liability for Microsoft Online Services. The parties agree that, other than Online Services, no other Microsoft Products shall be sold pursuant to the Master Agreement. As applicable to Online Services, the following terms and conditions shall apply: (Submitted: Jan 26, 2016 8:36:45 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 187
Part 2:
a. General. The total liability of each party for a purchase hereunder (Microsoft and each Purchasing Entity), including their Affiliates and contractors, for claims arising under the Master Agreement is limited to direct damages up to the amount a Purchasing Entity paid for the Online Service during the prior 12 months before the cause of action arose; but in no event will a partyâ€™s aggregate liability for any Online Service exceed the total amount paid for that Online Service under this Agreement. In the case of Online Services provided free of charge, previews, or code that a Purchasing Entity is authorized to redistribute to third parties without separate payment to Contractor, Microsoftâ€™s liability is limited to direct damages up to U.S. $5,000. These limitations apply regardless of whether the liability is based on breach of contract, tort (including negligence), strict liability, breach of warranties, or any other legal theory.
b. Affiliates and contractors. Microsoft and Purchasing Entity each agree not to bring any action against the otherâ€™s Affiliates or contractors in respect of any matter disclaimed on their behalf in this Agreement. Each party will be responsible for its actions in the event of any breach of this provision. (Submitted: Jan 26, 2016 8:38:53

AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 188
Part 3:
c. EXCLUSION OF CERTAIN DAMAGES. Neither party nor their Affiliates or contractors will be liable for any indirect, consequential, special or incidental damages, or damages for lost profits, revenues, business interruption, or loss of business information in connection with this agreement, even if advised of the possibility of such damages or if such possibility was reasonably foreseeable. d. Limits. The limits and exclusions in this section titled â€œLimitation of liabilityâ€ do not apply to either partyâ€™s (1) obligations under the section titled â€œDefense of third party claimsâ€ , (2) liability for damages State of Utah Bid CH16012
3/22/2016 4:23 PM p. 336
#15..
- 667 -
Question 188
Part 3:
c. EXCLUSION OF CERTAIN DAMAGES. Neither party nor their Affiliates or contractors will be liable for any indirect, consequential, special or incidental damages, or damages for lost profits, revenues, business interruption, or loss of business information in connection with this agreement, even if advised of the possibility of such damages or if such possibility was reasonably foreseeable. d. Limits. The limits and exclusions in this section titled â€œLimitation of liabilityâ€ do not apply to either partyâ€™s (1) obligations under the section titled â€œDefense of third party claimsâ€ , (2) liability for damages caused by either partyâ€™s gross negligence or willful misconduct, or that of its employees or its agents, and awarded by a court of final adjudication (provided that, in jurisdictions that do not recognize a legal distinction between â€œgross negligenceâ€ and â€œnegligence,â€ â€œgross negligenceâ€ as used in this subsection shall mean â€œrecklessnessâ€ ); and (3) liability for violation of its confidentiality obligations (except obligations related to Customer Data) or the other partyâ€™s intellectual property rights. (Submitted: Jan 26, 2016 8:39:39 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 189
Attachment A, Section 10, Subsection a(4) (4) Institution of proceedings under any bankruptcy, insolvency, reorganization or similar law, by or against Contractor, or the appointment of a receiver or similar officer for Contractor or any of its property, which is not vacated or fully stayed within thirty (30) calendar days after the institution or occurrence thereof; or
Exception
Microsoft respectfully requests to make this paragraph reciprocal. Please see the following proposed revised language:
(4) Institution of proceedings under any bankruptcy, insolvency, reorganization or similar law, by or against either party to this Master Agreement or to a Participating State or Purchasing Entity, or the appointment of a receiver or similar officer for any such party or any of such partyâ€™s property, which is not vacated or fully stayed within thirty (30) calendar days after the institution or occurrence thereof; or (Submitted: Jan 26, 2016 8:40:16 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 190
The following will be in two parts because of the size limit. part 1 RFP language:

Attachment A, Section 10, Subsections b and c b. Upon the occurrence of an event of default, Lead State shall issue a written notice of default, identifying the nature of the default, and providing a period of 30 calendar days in which Contractor shall have an opportunity to cure the default. The Lead State shall not be required to provide advance written notice or a cure period and may immediately terminate this Master Agreement in whole or in part if the Lead State, in its sole discretion, determines that it is reasonably necessary to preserve public safety or prevent immediate public crisis. Time allowed for cure shall not diminish or eliminate Contractorâ€™s liability for damages.
c. If Contractor is afforded an opportunity to cure and fails to cure the default within the period specified in the written notice of default, Contractor shall be in breach of its obligations under this Master Agreement and Lead State shall have the right to exercise any or all of the following remedies:
(1) Exercise any remedy provided by law; and
(2) Terminate this Master Agreement and any related Contracts or portions thereof; and (3) Suspend Contractor from being able to respond to future bid solicitations; and (4) Suspend Contractorâ€™s performance; and
(5) Withhold payment until the default is remedied. (Submitted: Jan 26, 2016 8:41:10 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 191
Part 2
Exception.

The minor changes we have made to these two Subsections are related to the above changes to Subsection a. (4), to the extent these are needed to support those changes. Revised language follows:
b. Upon the occurrence of an event of default, the party claiming default shall issue a written notice of default, identifying the nature of the default, and providing a period of 30 calendar days in which the non-defaulting party shall have an opportunity to cure the default. The Lead State shall not be required to provide advance written notice or a cure period and may immediately terminate this Master Agreement in whole or in part if the Lead State, in its sole discretion, determines that it is reasonably necessary to preserve public safety or prevent immediate public crisis. Time allowed for cure shall not diminish or eliminate defaulting partyâ€™s liability for damages. c. If a defaulting party is afforded an opportunity to cure and fails to cure the default within the period specified in the written notice of default, the defaulting party shall be in breach of its obligations under this Master Agreement and the non-defaulting party shall have the right to exercise any or all of the following remedies:
(1) Exercise any remedy provided by law; and
(2) Terminate this Master Agreement and any related Contracts or portions thereof; and (3) In the event of default by the Contractor, and to the extent permitted by the law of the Participating State or Purchasing Entity, the Lead State shall have the right to suspend Contractor from being able to respond to future bid solicitations; and
(4) Suspend Contractorâ€™s performance; and
(5) Withhold payment until the default is remedied. (Submitted: Jan 26, 2016 8:41:56 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 192
This will be 4 parts. 1 and two the RFP language 3 and 4 the question.

Part 1:

Indemnification
a. The Contractor shall defend, indemnify and hold harmless NASPO, NASPO ValuePoint, the Lead State, Participating Entities, and Purchasing Entities, along with their officers, agents, and employees as well as any person or entity for which they may be liable, from and against claims, damages or causes of action including reasonable attorneysâ€™ fees and related costs for any death, injury, or damage to property arising directly or indirectly from act(s), error(s), or omission(s) of the Contractor, its employees or subcontractors or volunteers, at any tier, relating to the performance under the Master Agreement. b. Indemnification â€“ Intellectual Property. The Contractor shall defend, indemnify and hold harmless NASPO, NASPO ValuePoint, the Lead State, Participating Entities, Purchasing Entities, along with their officers, agents, and employees as well as any person or entity for which they may be liable ("Indemnified Party"), from and against claims, damages or causes of action including reasonable attorneysâ€™ fees and related costs arising out of the claim that the Product or its use, infringes Intellectual Property rights ("Intellectual Property Claim") of another person or entity.
(1) The Contractorâ€™s obligations under this section shall not extend to any claims arising from the combination of the Product with any other product, system or method, unless the Product, system or method is:
(Submitted: Jan 26, 2016 8:44:53 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 193
part 2:
a) provided by the Contractor or the Contractorâ€™s subsidiaries or affiliates; (b) specified by the Contractor to work with the Product; or (c) reasonably required, in order to use the Product in its intended manner, and the infringement could not have been avoided by substituting another reasonably available product, system or method capable of performing the same function; or
(d) It would be reasonably expected to use the Product in combination with such product, system or method. (2) The Indemnified Party shall notify the Contractor within a reasonable time after receiving notice of an Intellectual Property Claim. Even if the Indemnified Party fails to provide reasonable notice, the Contractor shall not be relieved from its obligations unless the Contractor can demonstrate that it was prejudiced in defending the Intellectual Property Claim resulting in increased expenses or loss to the Contractor and then only to the extent of the prejudice or expenses. If the Contractor promptly and reasonably investigates and defends any Intellectual Property Claim, it shall have control over the defense and settlement of it. However, the Indemnified Party must consent in writing for any money damages or obligations for which it may be responsible. The Indemnified Party shall furnish, at the Contractorâ€™s reasonable request and expense, information and assistance necessary for such defense. If the Contractor fails to vigorously pursue the defense or settlement of the Intellectual Property Claim, the Indemnified Party may assume the defense or settlement of it and the Contractor shall be liable for all costs and expenses, including reasonable attorneysâ€™ fees and related costs, incurred by the Indemnified Party in the pursuit of the Intellectual Property Claim. Unless otherwise agreed in writing, this section is not subject to any limitations of liability in this Master Agreement or in any other document executed in conjunction with this Master Agreement
(Submitted: Jan 262016 8:45:27 AM MST)
State of Utah Bid CH16012
3/22/2016 4:23 PM p. 338
#15..
- 669 -
consent in writing for any money damages or obligations for which it may be responsible. The Indemnified Party shall furnish, at the Contractorâ€™s reasonable request and expense, information and assistance necessary for such defense. If the Contractor fails to vigorously pursue the defense or settlement of the Intellectual Property Claim, the Indemnified Party may assume the defense or settlement of it and the Contractor shall be liable for all costs and expenses, including reasonable attorneysâ€™ fees and related costs, incurred by the Indemnified Party in the pursuit of the Intellectual Property Claim. Unless otherwise agreed in writing, this section is not subject to any limitations of liability in this Master Agreement or in any other document executed in conjunction with this Master Agreement. (Submitted: Jan 26, 2016 8:45:27 AM MST) Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 194
part 3 Exception
Microsoft respectfully takes exception with this Section 13, as written, as it is overly broad in scope. Microsoft proposes the following alternative language:

Indemnification

13. Indemnification
a. Subject to the exceptions below and the NASPO Participantsâ€™ (as defined below) compliance with the notice and defense provisions below, in the event of any defect or deficiency in any Contractor Products or Services purchased by a Participating Entity or Purchasing Entity, Contractor agrees to defend NASPO, NASPO ValuePoint, the Lead State, Participating Entities, and Purchasing Entities, along with their officers, agents, and employees (collectively, the â€œNASPO Participantsâ€ ) against third party claims, damages or causes of action including reasonable attorneysâ€™ fees and related costs for any death, injury, or damage to tangible property suffered by such third party and caused by the negligence, or willful misconduct of Contractor, its employees or subcontractors or volunteers, at any tier, during the performance of this Master Agreement (a â€œPI Claimâ€ ).

This clause shall not be construed to bar any legal remedies Contractor may have with respect to the NASPO Participantsâ€™ failure to fulfill their obligations pursuant to the Master Agreement or any Participating Addendum. (Submitted: Jan 26, 2016 8:46:40 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 195
part 4 (of now 6 or 7)
To qualify for such defense, the Participating Entities/Purchasing Entities shall promptly notify Contractor of any PI Claim of which the Participating Entities/Purchasing Entities become aware which may give rise to a right of defense pursuant to this Section. Notice of any PI Claim that is a legal proceeding, by suit or otherwise, must be provided to Contractor within thirty (30) days of the Participating Entitiesâ€™/Purchasing Entitiesâ€™ first learning of such proceeding. If the Participating Entityâ€™s/Purchasing Entityâ€™s laws require approval of a third party to defend Participating Entity/Purchasing Entity, Participating Entity/Purchasing Entity will seek such approval and if approval is not received, Contractor is not required to defend that Participating Entity/Purchasing Entity. If a PI Claim is settled, to the extent permitted by law, the Participating Entities/Purchasing Entities shall not publicize the settlement and will cooperate with Contractor so that Contractor can make every effort to ensure the settlement agreement contains a non-disclosure provision.

Notwithstanding anything to the contrary contained herein, Participating Entities/Purchasing Entities agree that Contractor has no obligation for any PI Claim covered by this Section arising out of or resulting from the Participating Entitiesâ€™/Purchasing Entitiesâ€™ or any of their respective employeesâ€™, contractorsâ€™ or agentsâ€™ acts of negligence, gross negligence or misconduct. THE FOREGOING SHALL CONSTITUTE EACH AND EVERY PARTICIPATING ENTITYâ€™S/PURCHASING ENTITYâ€™S SOLE REMEDY AND CONTRACTORâ€™S SOLE AND EXCLUSIVE LIABILITY FOR ALL PI CLAIMS. (Submitted: Jan 26, 2016 8:48:45 AM MST)
Answer
- As stated in Section 3.4 of the RFP: "Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal."
The State will not negotiate or approve a change to the Master Terms and Conditions during the question and answer period. (Answered: Jan 26, 2016 8:53:13 AM MST)
Question 196
From the RFP, it appears we should ask for our exeptions during this Q and A period. If not, please confirm formally. From the RFP:
3 SOLICITATION REQUIREMENTS, INFORMATION AND INSTRUCTIONS

3.1 QUESTION AND ANSWER PERIOD
The RFP is issued by the State of Utah Division of Purchasing via Bidsync. The Division of Purchasing is the only contact for this solicitation. Do not contact any other Participating Entity about the RFP.

All questions MUST be submitted through BIDSYNC (www.bidsync.com) during the designated time for questions (â€œQ&A periodâ€ ) listed on Bidsync. Questions submitted through any other channel will not be answered.

Questions may be answered in the order that they are submitted or may be compiled into one document and State of Utah Bid CH16012
3/22/2016 4:23 PM p. 339
#15..
- 670 -
formally. From the RFP:
3 SOLICITATION REQUIREMENTS, INFORMATION AND INSTRUCTIONS

Questions may be answered in the order that they are submitted or may be compiled into one document and answered via an addendum. Answers disseminated by the State through the BidSync system shall serve as the official and binding position of the State and will constitute an addendum to this RFP.

Questions, exceptions, or notification to the State of any ambiguity, inconsistency, excessively restrictive requirement, or error in this RFP, MUST be submitted as a question through BidSync during the Q&A period.

Questions may be answered individually or may be compiled into one document. Questions may also be answered via addenda. An answered question or addenda may modify the specification or requirements of this RFP. Answered questions and addendums will be posted on BidSync. Offerors should periodically check BidSync for answered questions and addendums before the closing date. It is the responsibility of the Offerors to submit their proposal as required by this RFP, including any requirements contained in an answered question and/or addendums.

Exceptions to scope/content of the RFP within an Offerorâ€™s proposal that have not been previously addressed within the Q&A period of the procurement are not allowed and may result in the Offerorâ€™s proposal being considered non-responsive. (Submitted: Jan 26, 2016 9:15:15 AM MST) Answer
- Exceptions to the Master Terms and Conditions do not need to come through Bidsync. These can be attached to an Offeror's proposal.

If an Offeror believes that the RFP document contains an ambiguity, inconsistency, excessively restrictive requirement, or error in this RFP, then it MUST be submitted as a question through BidSync during the Q&A period. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 197
The latest Q&A contains the following question and answer:
â€œQuestion
Attachment B: Cloud Security Alliance Questionnaires
Please confirm whether the response requires both the CAIQ (Attachment B Exhibit 1) and CCM (Attachment B Exhibit 2) questionnaires, or if only one of the two is required. (Submitted: Jan 20, 2016 11:56:58 AM MST) Answer(s)
â€¢ The final RFP document will require that both documents be attached to a proposal. (Answered: Jan 25, 2016 2:23:05 PM MST) â€œ
The CAIQ contains specific questions with space for answers in columns E-I. The CCM does not. What expectations does NASPO have of vendors to properly respond to the Control Specifications in the CCM? (Submitted: Jan 26, 2016 10:07:36 AM MST)
Answer
- Offerors can complete separate documents that answers the questions contained in both the CAIQ and the CCM. An Offeror is not required to use the spreadsheets uploaded.

However, if an Offeror completes a separate document then it should keep the questions in the same order as listed on the spreadsheets. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 198

1. GENERAL PROVISIONS Section 2. SUBMITTING A PROPOSAL: By submitting a proposal in response to this RFP, the Offeror acknowledges that the minimum requirements, technical specifications, scope of work, and the evaluation process, outlined in this RFP are fair, equitable, not unduly restrictive, and understood. Any exceptions to the content of this RFP, including the specifications and minimum requirements, must be addressed during the Question and Answer period or protested in writing to the Division of Purchasing before the closing date and time.

Q: Please clarify how exceptions addressed in this way will be integrated into the Offerorâ€™s final proposal? (Submitted: Jan 26, 2016 10:28:39 AM MST)
Answer
- Any exception to the RFP documents as posted must be protested before the closing of the RFP.

Exceptions/additions to the Master Terms and Conditions will be negotiated as provided in the RFP documents.

An Offeror should not submit a proposal that takes exceptions to the mandatory minimum or technical criteria.

Those exceptions/questions should take place during the Question and Answer period. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 199

4. GENERAL PROVISIONS Section 18. PERFORMANCE AND COST ANALYSIS: The State reserves the right to review the awarded contract(s) on a regular basis regarding performance and cost, and may negotiate price and service elements during the term of the contract.

Q: Please clarify the process for price adjustments. Will this be done via an amendment process? (Submitted: Jan 26, 2016 10:29:35 AM MST)
Answer
- Offerors are providing a minimum discount to their price list in the cost proposal. As such, Offerors in providing the offerings need to do so at the price list minus the minimum discount.

If an offeror want to lower is minimum discount from say 5% to 3% then that needs to occur through an State of Utah Bid CH16012
3/22/2016 4:23 PM p. 340
#15..
- 671 -
review the awarded contract(s) on a regular basis regarding performance and cost, and may negotiate price and service elements during the term of the contract.

If an offeror want to lower is minimum discount from say 5% to 3% then that needs to occur through an amendment. However, if an Offeror provides a discount greater than its minimum discount in its cost proposal then it does not need to go through an amendment. (Answered: Jan 28, 2016 2:00:48 PM MST) Question 200
GENERAL PROVISIONS Section 19. AWARDED CONTRACT(S): Contract(s) awarded from this RFP will include the following documents: the scope of work, the appropriate State of Utah Standard Terms and Conditions, and any other documents listed in this RFP.

Q: Please clarify what is included in the â€œscope of workâ€ . Is this from a PO from the ordering agency? Q: What are these other documents? (Submitted: Jan 26, 2016 10:30:27 AM MST) Answer
- For this contract the scope of work will be the PO from the purchasing entities.

The other documents include the documents listed as part of this RFP. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 201

6. GENERAL INOFMRATION Section 2.1 PURPOSE
The State of Utah, Division of Purchasing (Lead State) is requesting proposals for cloud solutions in furtherance of the NASPO ValuePoint Cooperative Purchasing Program. The purpose of this Request for Proposals (RFP) is to establish Master Agreements with qualified Offerors to provide services related to cloud solutions for all Participating Entities. The objective of this RFP is to obtain best value, and achieve more favorable pricing, than is obtainable by an individual state or local government entity because of the collective volume of potential purchases by numerous state and local government entities. The Master Agreement(s) resulting from this procurement shall be extended to state governments (including departments, agencies, institutions), institutions of higher education, political subdivisions (i.e., colleges, school districts, counties, cities, etc.), the District of Columbia, territories of the United States, and other eligible entities subject to approval of the individual state procurement director and compliance with local statutory and regulatory provisions. The initial term of the Master Agreement shall be ten (10) years with no renewal provisions; however, Contract Vendors must submit an annual certification that they are still compliant with the mandatory minimum requirements and technical specification of the RFP.

Q: Will the MA and/or the PA list all eligible entities. (Submitted: Jan 26, 2016 10:30:59 AM MST) Answer
- States that are participating in this solicitation via the Master Agreement are listed in Attachment E.

For the State of Utah there is no list of eligible users. It is any entity that is entitled to use a cooperative contract by statute. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 202
GENERAL INOFMRATION Section 2.3 DEFITIONS Participating Addendum means a written statement of agreement signed by the Contract Vendor and a Participating State or Participating Entity that clarifies the operation of the Master Agreement for the Participating Entity (e.g. ordering procedures specific to Participating State) and may add other state-specific language or other requirements. A Participating Addendum evidences the Participating Entity's willingness to purchase and the Contract Vendor's willingness to provide Offerings under the terms and conditions of the Master Agreement with any and all exceptions noted and agreed upon.

Q: Is there a template of the Participating Addendum or can the Offeror use its own template? Q: Can a state extend the PA after the expiration of the MA? (Submitted: Jan 26, 2016 10:31:30 AM MST) Answer
- A template of the participating addendum will be customized after contract award.

A PA cannot be extended after the expiration of the MA. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 203
GENERAL INFORMATION Section 2.7.2 Master Agreement The Master Agreement(s) awarded from this RFP will consist of the RFP document, including all Exhibits, Attachments, and the winning Offeror's Proposal, in that order of precedence.

Q: Can an Offeror add their order specific terms on a master level or must it be done at the state level? Q: Can an Offeror expand the documents to include an ordering document template. (Submitted: Jan 26, 2016 10:31:50 AM MST)
Answer
- 1. Yes. Ordering specific terms and conditions can be done at either level. However, it is encouraged to negotiate as many terms and conditions during the Master Agreement.

2. Yes. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 204
GENERAL INFORMATION Section 2.14 NASPO ValuePoint eMarket Center In July 2011, NASPO ValuePoint entered into a multi-year agreement with SciQuest, Inc. whereby SciQuest will provide certain electronic catalog hosting and management services to enable eligible NASPO ValuePoint entity's customers to access a central online website to view and/or shop the goods and services available from existing NASPO ValuePoint Cooperative Contracts. The central online website is referred to as the NASPO ValuePoint eMarket Center Contract Because of the nature of these services, the NASPO ValuePoint Master Agreement Terms and Conditions (Attachment A) require only cooperation in providing ordering instructions on the eMarket Center.

Q: Is this the dedicated website referred to in Section 2.12? (Submitted: Jan 26, 2016 10:32:34 AM MST) Answer
- Yes. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 205
SOLICITATION REQUIREMENTS, INFORMATION AND INSTRUCTIONS Section 3.4 Exceptions to RFP and NASPO ValuePoint Master Agreement Terms and Conditions
Q: Does this Section mean that an Offeror can provide a list of exceptions or a proposed amendment that would form the basis of a negotiated agreement as part of their response? Q: Can an Offeror reference its global policies that are referenced in URLS? (Submitted: Jan 26, 2016 10:35:51 AM MST)
Answer
- 1. Yes, an Offeror can take exception/addition to the Master Terms and Conditions as part of its response to the RFP. An Offeror does not need to list its exceptions/additions to the Master Terms and Conditions during the Question and Answer Period.

2. Please provide more context regarding your second question. However, regarding the Master Terms and Conditions Offerors may not submit requests for exceptions and/or additions by reference to a vendor's website or URL. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 206
Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions Section 1.a. Master Order of Precedence
Any Order placed under this Master Agreement shall consist of the following documents:
â€¢ A Participating Entityâ€™s Participating Addendum (â€œPAâ€ ) â€¢ NASPO ValuePoint Master Agreement Terms & Conditions including the applicable Exhibits to the Master Agreement
â€¢ The Solicitation
â€¢ Contractorâ€™s response to the Solicitation, as revised (if permitted) and accepted by the Lead State; and â€¢ A Service Level Agreement issued against the PA
Q: Can an Offeror add its Ordering Document to these list of documents? (Submitted: Jan 26, 2016 10:36:39 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. The Lead State will not consider proposed modifications and/or additions to the Master Agreement Terms and Conditions after the deadline for proposals. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 207
Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions Section 8 Confidentiality, NonDisclosure, and Injunctive Relief Q: These terms seem to be one-sided. Can this be made mutual? (Submitted: Jan 26, 2016 10:37:17 AM MST) Answer
- Any exception and/or addition regarding the Master Agreement Terms and Conditions must be made in the Offerorâ€™s proposal. The Lead State will not consider proposed modifications and/or additions to the Master Agreement Terms and Conditions after the deadline for proposals. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 208
Attachment A: NASPO ValuePoint Master Agreement Terms and Conditions Section 19.b and c Ordering b. This Master Agreement permits Purchasing Entities to define project-specific requirements and informally compete the requirement among other firms having a Master Agreement on an "as needed" basis. This procedure may also be used when requirements are aggregated or other firm commitments may be made to achieve reductions in pricing. This procedure may be modified in Participating Addenda and adapted to Purchasing Entity rules and policies. The Purchasing Entity may in its sole discretion determine which firms should be solicited for a quote. The Purchasing Entity may select the quote that it considers most advantageous, cost and other factors considered.
c. Each Purchasing Entity will identify and utilize its own appropriate purchasing procedure and documentation.

Contractor is expected to become familiar with the Purchasing Entities' rules, policies, and procedures regarding the ordering of supplies and/or services contemplated by this Master Agreement.

Q: Will this be governed by state procurement procedures or the Master Agreement terms along with the PA? (Submitted: Jan 26, 2016 10:37:47 AM MST)
Answer
- This will be governed by a purchasing entities procurement procedures. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 209
On Page 34 Section 6.3 States "Offeror... shuold meet a minimum Dun and bradstreet (D&B) credit rating of 4A2." Would a Dun and Bradstreet Credit rating of 1R3 result in a fail of section 6.3. If so could the provided audited financial statements overcome that score? (Submitted: Jan 26, 2016 10:48:30 AM MST) Answer
- Offeror's proposals under 6.3 must meet the financial strength identified in that Section. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 210
Could you provide an example cloud scenario that we would be able to work with to demonstrate our capabilities? (Submitted: Jan 26, 2016 10:49:55 AM MST) Answer
- Unfortunately, there is no example of a cloud scenario used in this RFP to demonstrate an offeror's capabilities. (Answered: Jan 26, 2016 4:42:34 PM MST)
Question 211
Please confirm that offerors wishing to submit cloud solutions for multiple manufacturers may specify distinct discount percentages for products or product lines offered by each manufacturer within each of the three product categories identified (SaaS, IaaS, PaaS) in Attachment G.

For example:

Company A
SaaS Discount % 1
IaaS Discount % 2
PaaS Discount % 3
Company B
SaaS Discount % 4
IaaS Discount % 5
PaaS Discount % 6 (Submitted: Jan 26, 2016 11:07:59 AM MST) Answer
- Yes. This would be acceptable. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 212
In regards to question 207... what safeguards and assurances does a vendor have that items marked confidential or private will remain as such? Is the information retained, where is it retained and what assurances does a vendor have that this information will be properly secured? (Submitted: Jan 26, 2016 11:39:43 AM MST) Answer
- The documents are maintained on Bidsync. (Answered: Jan 26, 2016 4:42:34 PM MST) Question 213
2 part question: Is the cyber insurance part of the minimum mandatory requirements? Is this scored and can it be negotiable? (Submitted: Jan 26, 2016 11:42:01 AM MST) Answer
- The reference to cyber insurance from the RFP document has been removed. An Offeror can take exception to the insurance requirements in the Master Terms and Conditions. (Answered: Feb 1, 2016 4:19:32 PM MST) Question 214
Document: Cloud_Solutions_-_Request_for_Proposals_-_CH16012; Page: 23; Section: 5.6.5 â€œOfferor must provide a statement certifying that its service model offering(s) meet or exceed NIST definitions for service models.â€ Is this referring to the service model definitions in Attachment D? (Submitted: Jan 26, 2016 12:18:48 PM MST)
Answer
- Yes. (Answered: Feb 1, 2016 4:19:32 PM MST)
Question 215
Document: Cloud_Solutions_-_Request_for_Proposals_-_CH16012; Page: 28; Section: 8.1.3 â€œOfferor must identify for each service category(ies) the areas that each service category.â€ 1) Can a supplier add categories during the 10 year term? 2) Can a supplier add Services during the 10 year term? 3) Can a supplier move Services between service categories during the 10 year term? 4) Can a supplier remove services during the 10 year term? 5) Are there any restrictions around timing for these changes? Is so, what is the process for these changes? (Submitted: Jan 26, 2016 12:21:28 PM MST)
Answer
- An Offeror is not awarded a Service Category during this solicitation then an Offeror may attempt to be awarded a Service Model if the Lead State re-issues the solicitation, as permitted in 2.8.

For example if during this solicitation an Offeror is awarded a contract only for SaaS it cannot amend its contract to State of Utah Bid CH16012
3/22/2016 4:23 PM p. 343
#15..
- 674 -
3) Can a supplier move Services between service categories during the 10 year term? 4) Can a supplier remove services during the 10 year term? 5) Are there any restrictions around timing for these changes? Is so, what is the process for these changes? (Submitted: Jan 26, 2016 12:21:28 PM MST)
Answer
- An Offeror is not awarded a Service Category during this solicitation then an Offeror may attempt to be awarded a Service Model if the Lead State re-issues the solicitation, as permitted in 2.8.

For example if during this solicitation an Offeror is awarded a contract only for SaaS it cannot amend its contract to include PaaS or IaaS offerings unless it is awarded those service models during a re-solicitation. (Answered: Feb 1, 2016 4:19:32 PM MST)
Question 216

Page 61 ends

Modesto City CouncilJune 4, 2024

Modesto City Council
June 4, 2024