reglab/statecodes huggingface dataset:
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 6 - Email › Rule 36-1-6.1

Current through June 25, 2024
To increase security and limit spam and emailed viruses, ITS
				  has implemented and maintains mail relays on the inside and outside of the
				  firewall. All mail bound for state domain email addresses must come through the
				  outside mail relay and be "relayed" to the inside mail relays. The inside mail
				  relay forwards the mail on to the appropriate mail server. All outbound mail
				  going out passes through the inside mail relay before being forwarded to the
				  Internet. For this reason, agencies must adhere to the following guidelines for
				  mail:
A. No direct SMTP to and/or from
				the Internet. Agencies must utilize the ITS maintained mail relays for mail
				traveling in both directions.
B. No
				POP or IMAP from Internet to mail servers inside state network. Agencies must
				utilize a secure web interface (HTTPS) to access mail.
C. No POP or IMAP from state network to
				private mail accounts on Internet. Agencies must utilize a web interface
				(HTTP/HTTPS) to access this mail.
D. ITS recommends that Agencies forward all
				mail through to the inside mail relay and restrict TCP 25 inbound and outbound
				in their firewalls to the relays' addresses.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 6 - Email › Rule 36-1-6.2

Current through June 25, 2024
Each agency must establish policies to help employees use
				  email properly, to reduce the risk of intentional or inadvertent misuse, and to
				  ensure that official records transferred via electronic mail are properly
				  handled. Principle priorities include the following:
A. Email communications must not be
				unethical, fraudulent, harassing, obscene, or be perceived as a conflict of
				interest.
B. User must be
				instructed of the risk of opening file attachments they were not expecting to
				receive.
C. Email must be used to
				conduct official business only.
D.
				Clear text emails must not contain sensitive information. If sensitive
				information must be communicated using email, the email must be encrypted both
				in transport and at rest.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 7 - Virus Prevention › Rule 36-1-7.1

Current through June 25, 2024
Agencies are required to have a virus prevention program
				  that includes:
A. Maintaining virus
				scanning software on all servers and workstations.
B. Keeping virus signature files and scanning
				engines updated on a schedule relevant to the system. Workstations must be
				updated at least weekly, and servers must be updated at least daily. A more
				stringent schedule may be adopted if the agency deems the machine a higher
				risk.
C. Scanning all file
				attachments sent or received via e-mail using current anti-virus
				software.
D. Scanning all removable
				media upon connection/ insertion using current anti-virus software.
E. Immediately removing any infected
				workstation or server from the network until the virus has been
				cleaned.
F. Maintaining copies of
				virus-detection tools offline.
G.
				Keeping all servers and workstations current with operating system and software
				security patches.
H. Disabling Auto
				Play on all workstations and laptops.
I. Reporting all virus activity that is not
				automatically cleaned by the virus protection software to ISD as a security
				incident. Refer to Chapter 3 of the ESP for details regarding incident
				reporting.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 7 - Virus Prevention › Rule 36-1-7.2

Current through June 25, 2024
ITS will monitor for network activity that indicates the
				  presence of malicious code and upon detection will perform the following
				  actions:
A. For isolated infections,
				ITS will block access to the state network for infected workstations or servers
				and notify the agency contact. Once the agency contact confirms that the
				workstation or server has been cleaned, ITS will remove the block. Detailed
				information regarding this process is provided in the ISD-Ticket Response
				Guidelines document. State employees can access this document from the ITS
				website.
B. For cases of infection
				within an agency that have the potential to impact other agencies, ITS will
				limit or remove connections to the state network for the infected agency. Such
				drastic action will be considered any time the availability, reliability, or
				integrity of the state network is at risk, but ITS will attempt to work with
				the infected agency to find a mitigating alternative prior to removing
				access.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 8 - Firewalls › Rule 36-1-8.1

Current through June 25, 2024
ITS will maintain a perimeter firewall between the State
				  Network and the Internet. This firewall will provide address-translation to
				  public space for state agencies.
A.
				Inbound connections from the Internet will be restricted to only ports TCP 80
				and TCP 443, for only HTTP and HTTPS protocols. No other inbound-initiated
				ports will be allowed to servers residing on the State Network unless entering
				the state network over a VPN.
B.
				ITS will maintain a DMZ for applications that meet the following criteria:
1. Require inbound connections that are not
				HTTP or HTTPS
2. Declared
				business-critical by both the agency and ITS
3. Deemed as unsuitable for a VPN by
				ITS
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 8 - Firewalls › Rule 36-1-8.2

Current through June 25, 2024
Each agency is required to implement a firewall at the
				  perimeter of their network, to secure the LAN from any traffic originating
				  within the State Network. Each agency should define a rule set for their
				  firewall that is as restrictive as possible, permitting the minimum services
				  required for proper operation of inter-agency communication. All services not
				  required for proper operation should be denied by the rule
				  set.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 8 - Firewalls › Rule 36-1-8.3

Current through June 25, 2024
Firewalls must only be managed using secure protocols such
				  as SSH or HTTPS, and management should be allowed only from selected agency
				  workstations.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 9 - Data Encryption › Rule 36-1-9.1

Current through June 25, 2024
ITS requires that all sensitive data be encrypted using
				  industry standard algorithms Triple DES, AES, or SSL/TLS when traveling to/from
				  un-trusted networks and/or entities.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 9 - Data Encryption › Rule 36-1-9.2

Current through June 25, 2024
If an agency Internet-facing server gathers or transmits
				  sensitive data, the application must use, at minimum, SSL for the transaction.
				  The agency must acquire the Certificate Authority signed certificate for this
				  server from ITS.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 9 - Data Encryption › Rule 36-1-9.4

Current through June 25, 2024
Each agency must encrypt sensitive data stored on any of
				  their local systems. Agencies must also ensure that any sensitive data on
				  systems located offsite is properly encrypted.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 10 - Remote Access › Rule 36-1-10.1

Current through June 25, 2024
The following policies address connectivity into the state
				  network from any entity that resides outside the state network. This includes
				  third party entities' connectivity into the state network via both the public
				  Internet and private circuits.
A. All
				connections from any entities (state or third party) that reside on the outside
				of the state network must be made via a virtual private network (VPN)
				connection using industry-standard IPSec or SSL protocols.
B. VPNs may be client-based or LAN-to-LAN
				based.
1. Client-based VPNs are VPNs in which
				software (client) is installed on a remote user's computer and a secure
				connection is made between that VPN client and a VPN-capable terminating
				device. (i.e. VPN concentrator, firewall, router, server).
2. LAN-to-LAN VPNs are VPNs that are created
				between a VPN-capable device on a third party network and a VPN-capable device
				on the state network.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 11 - Passwords › Rule 36-1-11.1

Current through June 25, 2024
ITS requires, at minimum, that each state agency utilize the
				  following guidelines when developing their password policy. Each agency must
				  enforce their developed password policy and educate their users on the choice
				  and protection of passwords.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 11 - Passwords › Rule 36-1-11.2

Current through June 25, 2024
Each agency must adopt the following guidelines for password
				  administration:
A. Automated password
				input must not be allowed, except for simplified/single sign on systems that
				have been approved by ITS
B.
				Passwords must not be stored in clear text on hard drives or any other
				electronic media. If stored on electronic media, passwords must be classified
				as sensitive. Refer to Chapter 9 of the ESP for details regarding data
				encryption.
C. Access to
				password-protected systems must be timed out after an inactivity period of
				thirty (30) minutes or less.
D.
				Passwords for administrative accounts and accounts with access to sensitive
				data must be treated with a higher level of security, including:
1. Requiring password changes every thirty
				(30) days
2. Consideration of
				two-factor authentication
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 11 - Passwords › Rule 36-1-11.3

Current through June 25, 2024
Each agency must enforce the following guidelines for user
				  password creation:
A. Passwords must
				contain at least 8 characters.
B.
				Passwords must contain a combination of lower case letters, upper case letters,
				numbers, and at least one symbol.
C. Passwords must not contain the user
				ID.
D. Passwords must not include
				personal information about the user that can be easily guessed: user's name,
				spouse's name, kid's name, employee number, social security number, birth date,
				telephone number, city, etc.
E.
				Passwords must not include words from an English dictionary or foreign-language
				dictionary.
F. Passwords must not
				contain proper names, including the name of any fictional character or
				place.
G. Passwords must not
				contain any simple pattern of letters or numbers such a "qwertyxx", "12345678",
				or "xyz123xx."
H. Passwords must
				not be trivial, predictable or obvious.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 11 - Passwords › Rule 36-1-11.4

Current through June 25, 2024
Each agency must instruct their users to follow these
				  guidelines for the purpose of protecting passwords:
A. Passwords must not be disclosed to anyone
				except in emergency circumstances or when there is an overriding operational
				necessity.
B. Hard copies of
				passwords (i.e. printed out or written down) should be considered
				sensitive.
C. Passwords must not be
				sent in clear text over the network. Secure Shell (SSH) and HTTPS must replace
				Telnet and HTTP for authentication.
D. Passwords must be unique per
				user.
E. The password change
				interval is a maximum of ninety (90) days; however, ITS recommends that
				agencies consider using a 30 or 60 day interval depending on the classification
				of their data. Password reuse should be minimized or prohibited.
F. Default passwords must be
				changed.
G. Passwords must be
				required on all user accounts.
H.
				Passwords suspected to be stolen or cracked must be changed immediately and
				notification must be given to the user's supervisor and system
				administrator.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 11 - Passwords › Rule 36-1-11.5

Current through June 25, 2024
For users that have access to sensitive data or that have
				  system administrator rights, agencies must consider using two-factor
				  authentication. Two-factor authentication is a system wherein two different
				  factors are used in conjunction to authenticate.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 12 - Physical Access › Rule 36-1-12.1

Current through June 25, 2024
All data center facilities must be physically protected in
				  proportion to the criticality of the business functions and associated systems,
				  assets, and infrastructure.
A. Any
				computing resource connected to an agency LAN or to the State Network must be
				placed in an area that can be locked. Any PC that is left unattended during the
				day must be logged out or locked when inactive. Refer to Chapter 11 of the ESP
				for details regarding password requirements.
B. At minimum, wiring closets must be kept in
				an area that can be locked.
C. At
				minimum, State Network routers or switches must be kept in an area that can be
				locked. This includes remote offices.
D. Agencies should ensure that all laptops
				are stored in secure locations.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 12 - Physical Access › Rule 36-1-12.2

Current through June 25, 2024
Agencies with larger computer installations must:
A. Protect access with an access control
				system, normally a card access system.
B. Establish procedures for granting,
				modifying, and revoking access.
C.
				Establish procedures for recording information (date, time, etc.) to track
				access.
D. Require security related
				clearance as a result of employment. (For example, all ITS employees that have
				access to State Data Center facilities are sworn in as Information
				Confidentiality Officers as defined by legislation and are subject to
				background checks).
E. Use cameras
				to record activity in and around computer installation.
F. Establish a policy for archiving access
				system and video data. Agencies must archive access system and video data for a
				minimum period of 30 days.
G.
				Restrict visitors in the computer facilities. Visitors that are allowed access
				must sign a sign-in/out log and must be accompanied by an authorized staff
				member.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 12 - Physical Access › Rule 36-1-12.3

Current through June 25, 2024
Agencies with smaller computer installations must:
A. Protect access with locked rooms, at
				minimum.
B. Establish procedures
				for granting, modifying, and revoking access.
C. Establish procedures for recording
				information (date, time, etc.) to track access.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 12 - Physical Access › Rule 36-1-12.4

Current through June 25, 2024
Agencies should adhere to the following miscellaneous
				  physical security guidelines:
A. Each
				agency should locate alternate space that meets the same physical security
				requirements for a business recovery site. This site should be accessible
				24/7/365.
B. Backup and recovery
				materials (tapes, manuals, etc.) must be kept at a site that meets all security
				measures defined in this document. This site should be accessible
				24/7/365.
C. Areas housing
				environmental or electrical systems critical to computer facilities should be
				in a location that meets all security measures defined in this
				document.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 13 - Wireless Access › Rule 36-1-13.1

Current through June 25, 2024
The following policies address security and data integrity
				  measures required for implementing and securing wireless local area networks
				  that reside within the state network.
A. Any unauthorized and/or neglectful
				installations of wireless networks that expose the state's network
				infrastructure to intruders and/or attacks may result in that agency's
				connection to the state network being isolated.
B. Maintaining a secure wireless network is
				an ongoing process that requires greater effort than that required for other
				networks and systems.
C. Agencies
				must assess risks more frequently and test and evaluate system security
				controls more frequently when wireless technologies are deployed.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 13 - Wireless Access › Rule 36-1-13.2

Current through June 25, 2024
At minimum, the following security standards and network
				  configurations are required for the deployment and operation of all wireless
				  network installations:
A. The placement
				of wireless LAN Access Points (WAP) must be strategically located to minimize
				the interception of wireless signals by unauthorized individuals. The range of
				the signal must also be tested to ensure that signals are not being transmitted
				outside the intended coverage area.
B. All WAP installations must use encryption.
				WPA Version 2 with AES is the minimal level of acceptable encryption. WEP and
				WPA (version 1) are not permitted.
C. WPA Version 2 may be deployed in either
				"PSK mode" or "Enterprise mode" with specific requirements for each mode.
1. PSK mode deployment requirements:
a. The "key" or "pass-phrase" should be known
				and kept securely by as few personnel as possible.
b. The "key" or "pass-phrase" should be
				changed regularly. Regularly is defined as every three months for minimum
				standards, however, it is recommended to be changed every month.
c. Very strong password creation practices
				should be followed when creating WPA-PSK passwords. At minimum, 16 characters
				with a combination of lower case letters, upper case letters, numbers, and
				symbols should be used.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 14 - Laptop and Mobile Device Usage › Rule 36-1-14.1

Current through June 25, 2024
Each agency must adhere to the following policies for mobile
				  devices with sensitive data. A mobile device is defined as any electric and/or
				  battery operated device that can be easily transported and that has the
				  capability for storing, processing, and/or transmitting data including Laptops,
				  Portable Digital Assistants (PDAs), Tablet/Mini PCs, Blackberries, SmartPhones,
				  and Hand-Held PCs. It is recommended that agencies consider enforcing some or
				  all of these policies for any mobile device regardless of classification of the
				  data.
A. Agencies employing the use of
				mobile devices for access to agency systems or storage of agency data must
				appropriately secure those devices to prevent sensitive data from being lost or
				compromised, to reduce the risk of spreading viruses/malware, and to mitigate
				other forms of abuse.
B. While
				traveling and using a mobile device in public places, never leave the device
				unattended and take precautions to avoid the risk of unauthorized persons
				viewing information on-screen.
C.
				Agencies must consider software that aids in tracking and recovery of the
				mobile device if lost or stolen.
D.
				Agencies that allow the use of mobile devices for access to state data, must
				consider implementing a management platform that allows them to administer the
				appropriate security policy to all devices supported by the agency.
E. Access Control
1. Prohibit users from downloading, running,
				and/or installing software and applications or enabling unauthorized protocols
				or services without agency IT approval and assistance.
2. Mobile device users must minimize the
				potential loss of data via WiFi, 3G, or Bluetooth connections to their device
				by configuring them in a secure manner or turning those services off when not
				in use.
3. Disable boot-up
				capabilities of other drives. Disabling the secondary boot drive sequence
				hinders the ability to access the system from a secondary drive.
4. Rename the Administrator Account using a
				non-descript name.
5. Prevent the
				last user name from displaying in the login dialog box.
6. When connected to the state network,
				ensure only one active connected network interface is enabled at a time. For
				example, if WiFi is enabled, then other access methods are disabled.
7. Establish hard drive and/or BIOS password
				standards for the agency or each department of the agency. Enable these
				features on each mobile device and configure a password per this
				standard.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 15 - Disposal of Hardware/Media › Rule 36-1-15.1

Current through June 25, 2024
Each agency must determine if hardware/media contains any
				  sensitive data prior to disposal (scrap, destroy, transfer or rental/lease
				  return). If hardware/media contains sensitive data, one of the following
				  methods must be used prior to disposal.
A. Physical Destruction
This is the primary method that should be used for the
				  disposal of data storage devices containing sensitive data. The intent is to
				  completely destroy the data storage device beyond any possibility of data
				  recovery.
1. The agency should perform
				a complete and permanent elimination of data on the data storage
				device.
2. Physical destruction of
				data storage devices is performed by shredding, disintegrating, incinerating,
				pulverizing, and melting the data storage device
3. If a third party is contracted for the
				disposal of the data storage device, a certificate of destruction must be
				obtained.
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 15 - Disposal of Hardware/Media › Rule 36-1-15.2

Current through June 25, 2024
Each agency must erase all data and configuration
				  information, regardless of the classification of data, prior to disposal
				  (scrap, destroy, transfer, or rental/lease return) of
				  hardware.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 16 - Application Assessment and Certification › Rule 36-1-16.1

Current through June 25, 2024
Each agency must perform security assessments on all new
				  applications to ensure key application security and privacy requirements are
				  met. Code in the application and supporting infrastructure must be tested for
				  common errors that can compromise the integrity of the production environment
				  when the application is deployed.
A.
				Agencies should use one or more of the following application security
				assessment methods:
1. Contract with a
				third-party for assessment services
2. Perform Internal application security
				assessments
3. Utilize application
				security assessment software
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 16 - Application Assessment and Certification › Rule 36-1-16.2

Current through June 25, 2024
Each agency must document their application security
				  assessment process/results prior to deploying new applications. Agencies must
				  include all application assessment documentation to ITS as part of the
				  submission package satisfying the mandatory third-party security risk
				  assessment. Refer to Chapter 1 of the ESP for details regarding security risk
				  assessments.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 16 - Application Assessment and Certification › Rule 36-1-16.3

Current through June 25, 2024
Application security assessments must performed when an
				  application is modified or updated. ITS recommends that agencies perform
				  application assessments on a regular basis.
A. Follow-up application security assessment
				documentation must be submitted to ITS as part of the submission package
				satisfying the mandatory third-party security risk assessment. Refer to Chapter
				1 of the ESP for details regarding security risk assessments.
Miss. Code Ann. §
										25-53-1
				  to §
										25-53-25
Mississippi Administrative Code › Title 36 - Technology › Part 1 - Enterprise Security Policy › Chapter 17 - Removable Media › Rule 36-1-17.1

Current through June 25, 2024
Agencies must adhere to the following policies for removable
				  media regardless of classification of the data being stored.
A. Removable Media is defined as a device or
				media that is readable and/or writeable by the end user and is able to be moved
				from computer to computer without modification to the computer. This removable
				media policy pertains to, but is not limited to all devices and accompanying
				media that fit the following criteria:
1.
				Portable USB-based flash drives, also known as thumb drives, jump drives, or
				key drives;
2. Memory cards in SD,
				CompactFlash, Memory Stick or any related flash-based supplemental storage
				media;
3. USB card readers that
				allow connectivity to a PC;
4.
				Portable MP3 and MPEG-playing music and media player-type devices such as iPods
				with internal flash or hard drive-based memory that support a data storage
				function;
5. PDAs, cell phones, and
				Smartphones with internal flash or hard drive-based memory that support a data
				storage function;
6. Digital
				cameras with internal or external memory support;
7. Removable memory-based media, such as
				rewritable DVDs, CDs, tapes, and floppy disks;
8. External hard drives;
9. Any hardware that provides connectivity to
				USB devices through means such as wireless or wired network access;
				and
10. Any applicable emerging
				technology.
Mississippi Administrative Code › Title 36 - Technology › Part 2 - Information Systems Services › Chapter 3 - Glossary of Terms › Rule 36-2-3-203.1 - 005-125 Competitive Written Bid

Current through June 25, 2024
IT purchases over $5,000.00 but not over $50,000 ($25,000.00
				  for projects funded by the American Recovery and Reinvestment Act) have been
				  delegated by ITS to the purchasing entity. Purchases in this price range do not
				  require advertisement of bids but do require at least two competitive written
				  bids. "Competitive written bid," often referred to as a "written quote," is
				  defined as follows: a bid submitted on a bid form furnished by the buying
				  agency or governing authority and signed by authorized personnel representing
				  the vendor, or a bid submitted on a vendor's letterhead or identifiable bid
				  form and signed by authorized personnel representing the vendor. You must
				  select the lowest quote.
"Competitive" means the bids are developed based upon
				  comparable identification of the needs and are developed independently and
				  without knowledge of other bids.
25-53-5 (o); 31-7-13
				  (c)
Mississippi Administrative Code › Title 36 - Technology › Part 2 - Information Systems Services › Chapter 3 - Glossary of Terms › Rule 36-2-3-203.4 - 005-400 Lifecycle Cost

Current through June 25, 2024
The lifecycle cost of an information technology project
				  means the
total committed costs
of the project, not just the
				  initial or up-front costs. Lifecycle cost includes all costs associated with
				  obtaining the item and maintaining and operating it for its projected
				  lifecycle. Initial or one-time costs might include purchase price, freight,
				  installation, and training. Ongoing costs include such expenses as
				  post-warranty maintenance; support, including help desk charges, upgrade
				  charges, and on-site vendor personnel; and any recurring usage charges.
Examples:
(1) An
				acquisition of equipment with a projected lifecycle of five years, a purchase
				cost of $100,000, monthly hardware maintenance of $250, and related annual
				software fees of $10,000 has a lifecycle cost of $165,000 (($100,000 + ($250 x
				60 months) + ($10,000 x 5 years)).
(2) An acquisition of software from the
				Microsoft Enterprise Agreement is a three-year purchase commitment. The
				lifecycle cost is the cost per seat times the number of seats times 3 years.
(3) For a turn-key acquisition of
				hardware, system software, and consulting services for the development of an
				application system, the lifecycle costs consist of:
(a) all initial fees for hardware and
				software,
(b) hardware and software
				maintenance and support costs over the projected life of the hardware and
				system software,
(c) all consulting
				fees, including initial development, implementation, training, data conversion,
				and other requested services, and
(d) any applicable ongoing costs for support
				of the resulting application system.
As part of the procurement request to ITS, the customer is
				  asked to provide an estimate of the useful life of the acquisition prior to
				  replacement. This estimate is used as the lifecycle term over which the
				  lifecycle cost is computed.
See the definition of "Project", Section 005-600, for an
				  explanation of the implications of project lifecycle costs.
Mississippi Administrative Code › Title 36 - Technology › Part 2 - Information Systems Services › Chapter 3 - Glossary of Terms › Rule 36-2-3-203.5 - 005-600 Project

Current through June 25, 2024
Why define a project?
(1) Each ITS Express Products List (EPL)
				specifies a maximum spending limit
per project
. For projects
				costing up to the designated amount, ITS has delegated to the purchasing entity
				the authority and responsibility for selecting the lowest and best vendor for
				the specific project from among the offerings on the EPL. Projects with
total project lifecycle costs
above the EPL limit are beyond the
				scope of this delegated process and are subject to full ITS review and
				authorization. See Handbook Section 005-400 for the definition of lifecycle
				cost. [Note: with ITS participation and approval, EPLs can be utilized as the
				procurement instrument for projects above the EPL spending limit via the
				Planned Purchases process (Handbook Section 013-080) or by submitting a
				Competitive Procurement Request for ITS to issue a Letter of Configuration
				based on the appropriate EPL.
(2)
				For information technology projects involving the expenditure of funds above a
				specified limit, state law requires:
(a) that
				the acquisition be based upon competitive specifications;
(b) that the acquisition be publicly
				advertised; and
(c) that sealed
				proposals be received and evaluated to determine the lowest and best respondent
				[Mississippi Code Annotated, Section
				25-53-5(o)].
				State law further specifies that it is unlawful to split purchases in order to
				circumvent the requirements for advertising [Mississippi Code Annotated,
				Section
				31-7-13(o)].
				ITS policies and procedures use the
total project lifecycle cost
to determine whether a given acquisition is above the bid threshold and to
				further determine the procurement mechanisms that can legally be used for that
				acquisition. See Handbook Section 005-400 for the definition of total project
				lifecycle cost and ITS Procurement Limits Policies in Section 015-010 (State
				Agencies) and Section 015-020 (IHLs) for an overview of procurement mechanisms
				by lifecycle cost range. Note: The current bid threshold is $50,000 except for
				projects funded by the American Recovery and Reinvestment Act (ARRA). For ARRA
				projects, the bid threshold is $25,000.
Mississippi Administrative Code › Title 36 - Technology › Part 2 - Information Systems Services › Chapter 3 - Glossary of Terms › Rule 36-2-3-203.6 - 005-800 Silent Period

Current through June 25, 2024
The Silent Period is a period of time during procurement in
				  which any state employee directly or indirectly involved in any step in the
				  procurement process, including but not limited to procurement management,
				  development of specifications, evaluation of proposals, and contract
				  negotiations, should not communicate with prospective vendors. The silent
				  period typically applies to all employees of the customer agency. All
				  communications with potential vendors during the silent period should be
				  directed to the individual who is the contact person for the procurement or
				  should occur only as authorized by the contact person in conjunction with the
				  procurement process.
ITS recommends that customers begin the silent period at the
				  time they begin formal development of requirements and specifications. Prior to
				  that time, customers can and should communicate with vendors about the
				  marketplace and technologies as they formulate their project scope and
				  approach. At the point in time when a customer has done adequate research and
				  begins to formulate the specific requirements, the customer agency should cease
				  their communications with vendors in that marketplace to avoid any appearance
				  of impropriety or favoritism.
If a customer desires a more formal approach to marketplace
				  research, a Request for Information may be published. The RFI process is not
				  covered by the Silent Period. Customers that desire ITS assistance with the RFI
				  process should submit a Competitive Procurement Request form to ITS. Customers
				  that wish to conduct the RFI process without ITS involvement should submit an
				  Exemption Request form to ITS.
ITS also recognizes that incumbent vendors may be performing
				  work for the customer and that the work may or may not be related to the scope
				  of an active procurement. In those cases, the customer agency will naturally
				  continue to have contact with the vendor in the course of doing business. This
				  contact is not an issue. Customers should, however, take extra precaution to
				  avoid a perception of misconduct by (1) meeting in groups and avoiding
				  extensive one-on-one time with a vendor who provides the products and services
				  being acquired in the active procurement; and (2) not discussing the active
				  procurement.
25-53-5
				  (o)
Mississippi Administrative Code › Title 36 - Technology › Part 2 - Information Systems Services › Chapter 4 - Procurement Contacts › Rule 36-2-4-204.1 - 007-010 Procurement Contacts

Current through June 25, 2024
by Role
The responsibility for technology procurements lies with the
				  Information Systems Services (ISS) Division of the Mississippi Department of
				  Information Technology Services (ITS). The following individuals can assist you
				  with various aspects of technology procurement, whether you are a customer, a
				  vendor, or an interested party. Additional contact information for specific
				  procurements is published with the Request for Proposals or Letter of
				  Configuration.
If you reach voice mail and need to speak with someone
				  immediately, press "0," stay on the line, and explain to the ITS Receptionist
				  the type assistance needed.
Type Assistance:
Name
Telephone
E-mail
Procurement Help Desk
(Rotates)
601-432-8166
Procurement Help Desk
ISS Division Director
Lynn Ainsworth
601-432-8150
lynn.ainsworth@its.ms.gov
Procurement Process Specialist
Tina Wilkins
601-432-8161
tina.wilkins@its.ms.gov
Procurement Team Leaders:
Renée Murray
601-432-8146
renee.murray@its.ms.gov
Tangela Harrion
601-432-8112
tangela.harrion@its.ms.gov
Anthony Hardaway
601-432-8110
anthony.hardaway@its.ms.gov
EPL Questions
Contact the Procurement Help Desk
Public Record Requests
Jeanette Crawford
601-432-8179
open.records@its.ms.gov
Customer Invoices
Lynn Ainsworth
601-432-8150
lynn.ainsworth@its.ms.gov
ITS Switchboard
Receptionist
601-432-8000
25-53-5; 25-53-21;
				  25-53-25
Mississippi Administrative Code › Title 36 - Technology › Part 2 - Information Systems Services › Chapter 5 - Procurement Process › Rule 36-2-5-205.1 - 009-001 ITS Procurement Process Flows

Current through June 25, 2024
Diagrams of the ITS procurement process are provided below
Table of Contents:
*
ITS Procurement Process
*
Customer Purchase Process (after ITS approval
				  is received)
*
Details of Process by Procurement Type
* Competitive Procurement: RFP
* Competitive Procurement: LOC
* Revision to Previous Approval
* Sole Source Certification
* Exemption
* Emergency Purchase
* Planned Purchase
* Protest Process
* Quality Assurance Review
You may download a PDF version of the ITS Procurement
				  Process diagram from the ITS website by clicking the following link:
				  Procurement Flow ITS.pdf
Click Here
				  To View Image
Click Here
				  To View Image
Click Here
				  To View Image
Click Here
				  To View Image
Click Here
				  To View Image
Click Here
				  To View Image
Click Here
				  To View Image
Click Here
				  To View Image
Click Here
				  To View Image
Click
				  Here To View Image
Click
				  Here To View Image
Mississippi Administrative Code › Title 36 - Technology › Part 2 - Information Systems Services › Chapter 5 - Procurement Process › Rule 36-2-5-205.3 - 009-010 Procurement Process: Multi-Year Prepayment Approvals

Current through June 25, 2024
In accordance with the authority granted under Section
				  7-7-27
				  Mississippi Code Annotated, the Department of Finance and Administration (DFA),
				  by letter dated June 18, 2010, attached below, granted ITS the authorization to
				  approve contracts for multi-year prepayment of information technology services
				  and software licensing for ITS customer agencies. You may view this letter on
				  page 74.
This authorization is specifically applicable to projects
				  requiring ITS approval and does NOT apply to projects made under ITS'
				  purchasing delegations to agencies.
Prior to granting any approval for a multi-year prepayment,
				  ITS must carefully review the licensing or services to be provided to ensure
				  prepayment is both a standard business model for the licenses or services being
				  purchased and is advantageous to the State. If approved, ITS will ensure that
				  contracts for these purchases contain appropriate protective language to reduce
				  the risk of prepayment.
Once the prepayment has been approved, ITS will issue a
				  project-specific approval letter to the customer agency, in addition to the
				  usual CP-1 Acquisition Approval Document. The approval letter will cite the
				  authorization granted to ITS by DFA.
Agencies must attach a copy of the ITS approval letter to
				  the payment voucher (PV).
ITS Process for Approval of Prepayment for Technology
				  Under a Blanket Waiver from DFA
1. ITS receives a request from a customer for
				technology services or software licensing that could potentially include a
				multi-year prepayment. The most common situations for consideration of
				prepayment are warranty extensions, prepaid hardware support or software
				licensing, and prepaid hosting when the vendor must make a significant up-front
				investment in infrastructure.
2.
				ITS includes language in the Request for Proposals (RFP), Letter of
				Configuration (LOC), Request for Quotations (RFQ), or Invitation to Bid (ITB)
				specifying that vendors must:
a) provide
				pricing for one year as well as multi-year prepayment options that provide
				significant savings for the State so that the risks and benefits of prepayment
				can be evaluated; and/or
b) define
				and justify any prepayment requirements in vendor's business model for these
				services or software
Mississippi Administrative Code › Title 36 - Technology › Part 2 - Information Systems Services › Chapter 5 - Procurement Process › Rule 36-2-5-205.6 - 009-080 Procurement Process: Public Records Requests

Current through June 25, 2024
The diagrams below detail the ITS Public Records Request
				  Process.
Table of Contents:
Request for Standard Documents
Custom Request without 3rd party notification
Custom Request with 3rd party Notification
Public Records Process Flow:
You may download a PDF version of the ITS Public Records
				  Process diagrams from the ITS website by clicking the following link: Public
				  Records Process.pdf
Request for Standard Documents
Click
				  Here To View Image
Custom Request Without 3rd Party Notification
Click
				  Here To View Image
Custom Request With 3rd Party Notification
Click
				  Here To View Image
25-61-1, et
				  seq
Mississippi Administrative Code › Title 36 - Technology › Part 2 - Information Systems Services › Chapter 5 - Procurement Process › Rule 36-2-5-205.7 - 009-090 Procurement Process: Vendor Protests

Current through June 25, 2024
The ITS Protest Procedure and Policy outlines the process by
				  which any party who is aggrieved in a procurement process may file a formal
				  protest. ITS makes every effort to conduct fair and open procurements and to be
				  proactive in responding to any vendor concerns throughout the process. Vendors
				  are urged to contact the designated ITS project manager for the procurement as
				  soon as an issue or concern is noted. ITS will make every effort to evaluate
				  the concern and to respond appropriately without requiring the vendor to file a
				  formal protest.
Before filing a protest, vendors are strongly encouraged to
				  meet with ITS staff to review ITS process documentation for the relevant
				  procurement. Per the ITS Protest Procedure and Policy, vendors are required to
				  attend a Post Procurement Review before filing a formal protest of any contract
				  award.
Refer to 009-001 ITS Procurement Process Flows for
				  additional information, specifically the flow labeled Protest Process.
25-53-5
				  (n)
Mississippi Administrative Code › Title 36 - Technology › Part 2 - Information Systems Services › Chapter 5 - Procurement Process › Rule 36-2-5-205.8 - 009-100 Procurement Process: Disposals

Current through June 25, 2024
Disposals of Information Technology
				  Equipment
Agencies and institutions should dispose of computer and
				  telecommunications equipment in accordance with guidelines published by the
				  State Auditor's Office in the Property Officers Manual. Procedures for the
				  disposal of state property are further detailed in the Department of Finance
				  and Administration's Office of Purchasing, Travel, and Fleet Management
				  Procurement Manual Chapter 8.
The Department of Environmental Quality also provides
				  Computer Recycling Guidelines on its website, including information on
				  environmental issues related to the disposal of computer equipment.
Agencies and institutions need to consider the following
				  when disposing of or canceling leases for computer and telecommunications
				  equipment:
(1)
Cancellation of
				Insurance and/or Maintenance Coverage
*
If you dispose of or transfer equipment
				  covered by insurance, be sure to coordinate cancellation/transfer of insurance
				  as well so that you will not be liable to pay insurance coverage on equipment
				  that has been disposed of or transferred.
*
If you dispose of or transfer equipment
				  covered by vendor maintenance, be sure to cancel this maintenance so that you
				  will not be liable to pay for maintenance on equipment you no longer have.
(2)
Disposal of Equipment with
				Accruals
If your agency/institution has been renting or leasing
				  equipment that is still of value and has accruals that can be applied toward a
				  purchase, you should attempt to locate another state agency or institution that
				  would like to take advantage of those accruals.
(3)
Disposal of Equipment With
				Value
If your agency/institution is disposing of equipment that is
				  still working or that could be of some value, you should attempt to locate
				  another state agency or institution that would like to have the equipment. The
				  recipient should be aware, however, of any costs associated with operating or
				  maintaining the equipment that might result in more expense to the recipient
				  than newer technology. The recipient should also be aware that these associated
				  costs may require ITS approval.
(4)
Disposal of Equipment as
				Salvage
Training centers such as those at state community colleges
				  and high schools can often use broken or old equipment for spare parts or to
				  train students on equipment assembly and repair.
Regardless of the disposal method used, each agency or
				  institution must ensure that all proprietary computer programs and all data
				  have been completely erased from storage devices prior to disposal or transfer
				  of the equipment, using industry best practices to ensure the information
				  cannot be reconstructed.
25-53-5
				  (c)