Page 226

Non-security functional and technical requirements shall be a part of the hardware, software, or firmware acquisition process. l. Agencies shall follow State procurement policies when acquiring hardware to ensure that the purchase meets specified functional needs. Agencies shall include specific requirements for performance, reliability, cost, capacity, security, support, and compatibility in Requests for Proposals (RFPs) to rigorously evaluate quotes. m. Agencies shall ensure vendor compliance with State and Federal security State and Federal laws, regulations, guidelines, standards, policies, and procedures. Agencies shall also obtain a Vendor Risk Assessment (VRA) for the vendor prior to contract approval. This document is intended to help agencies reach a decision for specific systems that will meet the State’s security and compliance requirements. A VRA is required regardless of where the system is hosted. n. New system purchases shall meet, at a minimum, current operational specifications and have scalability to accommodate for growth projected by the agency. o. SA-4 (1) ACQUISITION PROCESS – FUNCTIONAL PROPERTIES OF CONTROLS Developer(s) of the system, system component, or information system service shall provide a description of the functional properties of the security controls to be employed. Functional properties of security controls describe the functionality (e.g., security capability, functions, or mechanisms) visible at the interfaces of the controls and specifically exclude functionality and data structures internal to the operation of the controls. SA-4 (2) ACQUISITION PROCESS – DESIGN AND IMPLEMENTATION INFORMATION FOR CONTROLS Developer(s) of a system, system component, or information system service shall provide design and implementation information for the security controls to be employed that includes the following: security-relevant external system interfaces, high-level design, source code, or hardware schematics. SA-4 (9) ACQUISITION PROCESS – FUNCTIONS, PORTS, PROTOCOLS, AND SERVICES IN USE Developer(s) of a system, system component, or information system service shall identify the functions, ports, protocols, and services intended for use. SA-4 (10) ACQUISITION PROCESS – USE OF APPROVED PIV PRODUCTS Agencies may use information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) within State systems. SA-5 SYSTEM DOCUMENTATION Organizations must obtain, develop, or document administrator and user documentation for the system, system component, or system service. Such documentation shall be distributed to designated agency officials that describes: System and Services Acquisition Policy GV-PO-P5 Effective Date: 01/31/2025 Date Approved: 01/15/2025 Version: 1 Page #: 4 of 12