S2: Vendor Security Compliance Submission Requirement Validation

Notice: applying this to your agency.

The IT Project Resources are not meant to replace your agency’s internal project management practices or prescribe how you must operate. Instead, they offer concepts and tools that can strengthen delivery by providing a scalable framework for project level coordination. All project documentation should be maintained throughout each stage in alignment with agency policies and, where applicable, WaTech requirements and oversight expectations.

 

For Programs and Projects

Vendor Security Compliance Validation ensures that any third‑party product, service, or cloud solution used by the program or project meets Washington State’s cybersecurity, privacy, and enterprise architecture requirements. While no single WaTech policy uses the phrase “Vendor Security Compliance Validation Package,” statewide cybersecurity policies require agencies to validate vendor security controls, document risks, and provide evidence during Security Design Reviews and procurement decisions.

This task is to be a prompt to ensure you take time to look at requirements to satisfy WaTech’s security, privacy, and procurement expectations. Vendor security validation is required because statewide policies mandate that agencies:

  • Ensure third‑party systems meet statewide cybersecurity standards (SEC‑01).
  • Provide system security documentation for review and authorization (SEC‑02).
  • Identify and assess risks introduced by vendors and external systems (SEC‑11).
  • Apply appropriate controls based on data classification (IT Policy 141.10).
  • Validate cloud vendor responsibilities using the Shared Responsibility Model (WaTech Cloud Standards).
  • Evaluate vendor security posture during procurement (state procurement guidance).

Programs and projects must validate that all vendors:

  • Collect evidence of privacy compliance (HIPAA, FERPA, CJIS, GDPR), including a Privacy Impact Assessment (PIA) when applicable.
  • Require results from recent vulnerability scans or penetration tests, including mitigation strategies.
  • Validate vendor certifications and attestations (SOC 2 Type II, ISO 27001, FedRAMP).
  • Review vendor responses to WaTech’s Shared Responsibility Model for cloud solutions.
  • Require Business Continuity and Disaster Recovery Plans, including RTO/RPO targets.
  • Facilitate Security Review Board (SRB) sessions for vendor walkthroughs and clarifications.
  • Implement security controls that meet statewide cybersecurity requirements.
  • Provide documentation required for Security Design Review (SDR).
  • Demonstrate compliance with privacy, data protection, and regulatory obligations.
  • Support enterprise architecture, hosting, and integration standards.
  • Provide evidence of risk management, continuity planning, and operational safeguards.

For Programs with Agency‑Led Sub‑Projects

Agencies must ensure that any vendor or third‑party solution procured at the agency level undergoes the same validation process as the enterprise program. Agencies contribute:

  • Agency‑specific compliance requirements.
  • Local access control and data protection needs.
  • Legacy system constraints.
  • Additional regulatory obligations (HIPAA, CJIS, FERPA, etc.).

WaTech Deliverables: None, Provided during Security Design Review (SDR) and Design Review Transformation (DRT) process