2016-08-02-agreement-elmview - Laserfiche WebLink

Home Browse Search

Exhibit A -Data Security Requirements 1 . Qefinitions. The words and phrases listed below, as used in this Exhibit, shall each have the following definitions: a. ~Authorized User(s}-means an individual or individuals with an authorized business requirement to access DSHS Confidential Information. b. "Hardened Password" means a string of at least eight characters containing at least one alphabetic character, at least one number and at least one special character such as an asterisk, ampersand or exclamation point. c. "Unique User 10" means a string of characters that identifies a specific user and which, in conjunction with a password, pass phrase or other mechanism, authenticates a user to an information system. 2. Data Transport. When transporting DSHS Confidential Information electronically, including via email, the Data will be protected by: a. Transporting the Data within the (State Governmental Network) SGN or Contractor's internal network, or; b. Encrypting any Data that will be in transit outside the SGN or Contractor's internal network. This includes transit over the public Internet. 3. Protection of Data. The Contractor agrees to store Data on one or more of the following media and protect the Data as described: a. Hard disk drives. Data stored on local workstation hard disks. Access to the Data will be restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User 10 and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. b. Network server disks. Data stored on hard disks mounted on network servers and made available through shared folders. Access to the Data will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User 10 and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on disks mounted to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. For DSHS Confidential Information stored on these disks, deleting unneeded Data is sufficient as long as the disks remain in a Secured Area and otherwise meet the requirements listed in the above paragraph. Destruction of the Data as outlined in Section 5. Data Disposition may be deferred until the disks are retired, replaced, or otherwise taken out of the Secured Area. c. Optical discs (CDs or DVDs) in local workstation optical disc drives. Data provided by DSHS on optical discs which will be used in local workstation optical disc drives and which will not be transported out of a Secured Area. When not in use for the contracted purpose, such discs must be locked in a drawer, cabinet or other container to which only Authorized Users have the key, combination or mechanism required to access the contents of the container. Workstations which access DSHS Data on optical discs must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. DSHS Central Contract Services 1769CS County Agreement 7-14-2015 Page 18