Page 229

establish and maintain compliance with State policies. Agencies shall approve any changes to services provided by a third party prior to implementation. j. Agencies shall develop a process for engaging service providers and maintain a list of all service providers who store or share confidential data. k. Agencies shall ensure that the service-level agreement (SLA) includes requirements for regular monitoring, review, and auditing of the service levels and security requirements as well as incident response and reporting requirements. The SLA shall state how the service provider is responsible for data stored or shared with the provider. l. Agencies shall perform the monitoring, review, and auditing of services to monitor adherence to the SLA and identify new vulnerabilities that may present unreasonable risk. Agencies shall enforce compliance with the SLA and must be proactive with third parties to mitigate risk to a reasonable level. m. Changes to an SLA and services provided shall be controlled through formal change management. n. Agencies shall prohibit the use of non-agency-owned information systems, system components, or devices that receive, process, store, or transmit confidential data, including Federal Tax Information (FTI), unless explicitly approved by OIT. o. SA-9 (2) EXTERNAL SYSTEM SERVICES – IDENTIFICATION OF FUNCTIONS, PORTS, PROTOCOLS, AND SERVICES Providers of external system services shall identify the functions, ports, protocols, and other services required for the use of such services. Information from external service providers regarding the specific functions, ports, protocols, and services used in the provision of such services can be particularly useful when the need arises to understand the trade-offs involved in restricting certain functions/services or blocking certain ports/protocols. SA-10 DEVELOPER CONFIGURATION MANAGEMENT System developers shall create and implement a configuration management plan that does the following: Performs configuration management during system design, development, implementation, operation, and/or disposal for the following: Internal system development and system integration of commercial software. i. External system development and system integration. ii. a. Documents, manages, and controls changes to the system or configuration items and the potential security and privacy impacts. b. Implements only agency approved changes to the system. c. Documents approved changes to the system. d. Tracks security flaws and flaw resolution within the system. e. Mitigates the risk of exploitation of covert channels by protecting the source code in custom developed applications. f. SA-11 DEVELOPER TESTING AND EVALUATION System and Services Acquisition Policy GV-PO-P5 Effective Date: 01/31/2025 Date Approved: 01/15/2025 Version: 1 Page #: 7 of 12