System and Services Acquisition Standards Sample Clauses

System and Services Acquisition Standards i. All Information Systems and services must be procured and contracted for with explicit consideration of information security requirements including criteria for: 1. Evaluation, which require an explicit description of information security functionality and at least a high-level security architecture description, and acceptance of Information Systems and services, 2. Enforcement provisions including a description of interconnection requirements (e.g.: ports, protocols, services, etc.), 3. Legal and contractual requirements for data sources that will be used in connection with the Information System or services, and 4. Detailed documentation of all information security functions and mechanisms and privileged Information System functions so that EOHHS can fully and independently implement and operate the Information System. 5. Configuration and change management to ensure that only EOHHS- approved configurations and changes are implemented. 6. Security flaw testing (including code testing using analysis tools), tracking, remediation, and resolution. Within twelve (12) months of publication of Version 1.0 of these EOHHS Enterprise Information Security Standards, the EOHHS Security Office will promulgate standard language to incorporate in procurement and contract documents. That standard language will, to the extent feasible, require external entities providing Information Systems or services to abide by the requirements outlined herein. Owners must ensure that appropriate resources are allocated to ensure information security standards can be appropriately implemented. Such standards will be crafted in accordance with appropriate legal and contractual drivers, identified pursuant to Section VIII, Inventory and Classification and Attachment 2. ii. Owners must adopt a system development lifecycle methodology that appropriately accounts for information security considerations and permits identification of responsible parties for information security, testing of information security measures, and integrates information security risk management principles into the development lifecycle. iii. At EOHHS’s option, all externally provided Information Systems and services must be assessed, either by EOHHS or by an external auditor. No externally provides services should be further subcontracted without EOHHS’s express approval and review. iv. All Sensitive Information must be hosted within the United States. Sensitive Information must only be accessed from within the...