Page 225

What are the security objectives required by the system, e.g., integrity, confidentiality, and availability? ii. What regulations, statutes, and policies are applicable in determining what is to be protected? iii. What are the applicable threats? iv. What kinds of data will be used? v. SA-4 ACQUISITION PROCESS Functional security requirements shall be a part of any acquisition process. Agencies shall be capable of acquiring necessary solutions in an expedient manner in accordance with State requirements. The following shall be done: Security and privacy functional requirements shall include security capabilities, security functions, and security mechanisms. a. Strength of mechanism requirements shall be determined by a categorization of the system and the information processed, stored, and transmitted based on an impact analysis. The process to determine a system categorization can be found in the NIST Federal Information Processing Standard 199 (FIPS 199) documentation. The results of this categorization will indicate a baseline of security controls to follow; either Low, Moderate, or High, and will correspond to the security controls identified in NIST SP 800-53. b. Security and privacy assurance requirements shall include: Development processes, procedures, practices, and methodologies. i. Evidence from development and assessment activities indicating the required security and/or privacy functionality is implemented, and the required security strength achieved. ii. c. Controls needed to satisfy security and privacy requirements. d. Security and privacy documentation requirements. e. Description of the information system development environment and environment in which the system is intended to operate. f. Acceptance criteria requirements for assessing the ability of a system component, software, or system to perform intended functions. g. Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management. h. Vendor hardware design shall comply with information security and other State policies and standard security and technical specifications, such as: Adequate capacity to fulfill the functional requirements stated in the agency’s design document. i. Vendor-configured hardware security controls to adequately protect data. (Optionally, the vendor may assist the agency with the configuration of software security controls to provide adequate data protection on the vendor’s hardware.) ii. i. Systems under consideration for acquisition shall be interoperable with current peripherals and systems. j. Third-party applications shall be obtained from reputable sources to mitigate risk of covert channels exploitation. k. System and Services Acquisition Policy GV-PO-P5 Effective Date: 01/31/2025 Date Approved: 01/15/2025 Version: 1 Page #: 3 of 12