Page 228

Reducing risk to acceptable levels, thus enabling informed risk management decisions. h. SA-9 EXTERNAL SYSTEM SERVICES Agencies shall require third parties and providers of external system services to comply with statewide information security and privacy requirements. Agencies shall employ controls as follows: Define and document how external information systems comply with statewide information security and privacy controls to include user roles and responsibilities, and compliance auditing and reporting requirements. Agencies must ensure vendor compliance with State and Federal laws, regulations, guidelines, standards, policies, and procedures. It is also highly recommended that agencies obtain a third-party risk assessment prior to contract approval. a. Monitor security and privacy control compliance by external service providers on an ongoing basis. b. Restrict the location of information systems that receive, process, store, or transmit State and Federal data to the Continental United States (CONUS), United States Territories, Embassies and Military installations. c. Agencies outsourcing their information processing shall ensure the service provider demonstrates compliance with State and Federal laws, regulations, guidelines, standards, policies, procedures, and related industry quality standards. d. Outsourcing agreements shall include the following: The agency’s course of action and remedy if the vendor’s security and privacy controls are inadequate such that the confidentiality, integrity, or availability of the agency’s data cannot be assured. i. The vendor’s ability to provide an acceptable level of processing and information security during contingencies or disasters. ii. The vendor’s ability to provide processing in the event of failure(s). iii. e. To support service delivery, the outsourcing agreements shall contain, or incorporate by reference, all the relevant security and privacy requirements necessary to ensure compliance with the statewide information security standards, the agency’s record retention schedules, its security policies, and its business continuity requirements. f. Services, outputs, and products provided by third parties shall be reviewed and checked at least annually. g. To monitor third party deliverables, agencies shall do the following: Monitor third-party service performance to ensure service levels meet contract requirements. i. Review reports provided by third parties and arrange regular meetings as required by contract(s). ii. Resolve and manage any identified problem areas. iii. h. Contracts with vendors providing offsite hosting or cloud services that will host sensitive or confidential data must require the vendor to provide the State a third-party risk assessment due diligence response and supporting documentation such as, but not limited to Service Organization Control (SOC) 2 Type II, International Organization for Standardization (ISO) 27001, Federal Risk and Authorization Management Program (FedRAMP Moderate), or CSF (Common Security Framework) report before contract award and annually thereafter to i. System and Services Acquisition Policy GV-PO-P5 Effective Date: 01/31/2025 Date Approved: 01/15/2025 Version: 1 Page #: 6 of 12