Port of Seattle

Buyer requires implementation of comprehensive information security standards across ICT systems. The standards cover access control, audit capabilities, configuration management, authentication, and data protection. Requirements include implementing role-based access, secure password policies, encrypted data transmission, and vulnerability scanning. The buyer emphasizes PCI compliance with specific requirements for payment card data handling and EMV certification.

• 5/7/2025 - Proposal Due Date

• Implement access control systems with role-based schemes
• Configure automated account disabling after 90 days inactivity
• Establish least privilege principles across all system components
• Implement session lock functionality after 15 minutes inactivity
• Configure PAN/SSN masking and encryption
• Set up comprehensive audit logging and monitoring
• Implement centralized audit record collection and review
• Configure file integrity monitoring for critical system files
• Implement two-factor authentication for privileged and remote access
• Ensure proper encryption for all data transmission
• Configure secure password policies with 8-character minimum complexity
• Deploy malicious code protection with weekly updates
• Implement EMV-compliant credit card processing terminals
• Establish secure backup procedures with encryption
• Secure wireless environments by changing default configurations
• Remove unnecessary functionality from servers
• Follow OWASP guidelines for application development
• Set up vulnerability scanning capabilities
• Configure Bitlocker encryption for Windows laptops
• Establish key management procedures with restricted access