requirements, including those relating to the prevention and detection of fraud and any other inappropriate use or access of systems and networks. All data in transit and at rest must be encrypted. All data in transit and rest must remain in the continental United States. The network traffic to and from the proposed hosted solution must be encrypted using SSL or stronger. The proposed system must not use proprietary encryption techniques. The system must use AES 256 or higher encryption. The standard for exchange of data within the system must be a secure hypertext transport protocol or https. For any breach or suspected breach of security of the collected data, the Vendor shall: Notify the MDES designated contact within one (1) hour by telephone or e-mail of the breach/suspected breach; Conduct an investigation of the identified breach/suspected breach(describe the process followed); Confiscate, document and secure any evidence supporting the identified problem; Provide MDES with a written report of the investigation within three (3) business days of identification of the breach/suspected breach; Provide a detailed written report within seven (7) business days outlining the impact of the breach and the steps taken to correct the situation, prevent future breaches, and the time frame for resolution. Assist MDES, including testifying, in any proceedings or hearings, which occur as the result of the breach/suspected breach. Data Storage
Vendor shall use industry best practices to update all systems and third party software security patches to reduce security risk. Vendor shall protect their systems with anti-virus, host intrusion protection, incident response monitoring and reporting, network firewalls, application firewalls, and employ system and application patch management to protect its network and customer data from unauthorized disclosure. Vendor shall be solely responsible for all data storage required, starting on Day 1 (no archiving of prior history is required). See Section 7.3.6 for storage requirements after startup. Vendor shall take all necessary measures to protect the data including, but not limited to, the backup of the servers on a daily basis in accordance with industry best practices and encryption techniques. Vendor agrees to have appropriate controls in place to protect critical or sensitive data and shall employ stringent policies, procedures, and best practices to protect that data particularly in instances where sensitive data may be stored on a Vendor controlled or owned electronic device. Vendor shall utilize a secured backup solution to prevent loss of data, back up all data every day and store backup media. Stored media must be kept in an all-hazards protective storage safe at the worksite and when taken offsite. All back up data and media shall be encrypted. Online and offsite data retention period has been established as six (6) years from the time of collection. Cost options for Tape and/or Disk are solicited. Adherence to Policy Vendor support and problem resolution solution shall provide a means to classify problems as to criticality and impact and with appropriate resolution procedures and escalation process for each classification of problem. Vendor shall comply with all pertinent federal and state privacy regulations. REFERENCES Vendor must provide at least three (3)three (3) references. A form for providing reference information is attached as Attachment B. ITS requires that references
ATTACHMENT C PROPOSAL EXCEPTION SUMMARY FORM ITS LOC Reference Vendor Proposal Reference Brief Explanation of Exception ITS Acceptance (sign here only if accepted) (Reference specific outline point to which exception is taken) (Page, section, items in Vendor’s proposal where exception is explained) (Short description of exception being made) ATTACHMENT D PROJECT NUMBER 43163 PROFESSIONAL SERVICES AGREEMENT BETWEEN VENDOR NAME AND MISSISSIPPI DEPARTMENT OF INFORMATION TECHNOLOGY SERVICES AS CONTRACTING AGENT FOR THE MISSISSIPPI DEPARTMENT OF EMPLOYMENT SECURITY This Professional Services Agreement (hereinafter referred to as “Agreement”) is entered into by and between VENDOR NAME a INSERT DATE MODIFIED corporation having its principal place of business at VENDOR ADDRESS (hereinafter referred to as “Contractor”), and Mississippi Department of Information Technology Services having its principal place of business at 3771 Eastwood Drive, Jackson, Mississippi 39211 (hereinafter referred to as “ITS”), as contracting agent for the Mississippi Department of Employment Security located at 1235 Echelon Parkway, Jackson, Mississippi 39213 (hereinafter referred to as “Customer”). ITS and Customer are sometimes collectively referred to herein as “State”. WHEREAS, Customer, pursuant to Letter of Configuration Number 43163 dated INSERT DATE OF PUBLICATION (hereinafter referred to as “LOC”), based on Request for Proposals (“RFP”) No. 3849 requested proposals for the acquisition of mainframe hosting services, and WHEREAS, Contractor was the successful proposer in an open, fair and competitive procurement process to provide the services described herein;