This document outlines security requirements for contractors developing, maintaining, or hosting applications for the Ohio Department of Job and Family
Services (ODJFS). Key requirements include data encryption in transit and at rest, data execution prevention (DEP), address space layout randomization (ASLR), secure enclaves for cloud environments, unique user sessions, access control checks, input validation, hardening configurations, component identification and provision of supported versions at contract conclusion, disabling auto-complete and caching for sensitive data, avoiding redirects, audit logging requirements (including user account management, application errors, security policy modifications, and access to personally identifiable information), audit log retention, aggregation, and analysis, and secure transmission of audit logs to ODJFS tools. Annual audits (AICPA SSAE No. 18, SOC 1 Type 2 and SOC 2 Type 2 reports, and SOC 1 Type 1 for financial transactions) are required for cloud-based or contractor-hosted solutions. The contractor is responsible for all audit costs and must provide results within 30 days of completion. The state may audit controls and security measures without notice. Prohibition of using production data in non-production environments is also stated. DevOps vulnerability scanning, penetration testing, release and change management, and use of cloud-agnostic products and
services are also required. Specific development methodologies (e. g. , . NET, Java, Salesforce) and tools (e. g. , Git, Azure DevOps, Jenkins, Copado,
ServiceNow) are mentioned. Database read replicas and data dictionaries are also required. Infrastructure as code (IAC) is preferred, using declarative definition files where possible.