Laserfiche WebLink
(a} Encrypt the Data with a key length of at least 128 bits <br />(b} Control access to devices with a Unique User ID and Hardened <br />Password or stronger authentication method such as a physical token <br />or biometrics. <br />(c} Manually lock devices whenever they are left unattended and set <br />devices to lock automatically after a period of inactivity, if this feature is <br />available. Maximum period of inactivity is 20 minutes. <br />Physically Secure the portable device(s} and/or media by <br />(d} Keeping them in locked storage when not in use <br />(e} Using check-in/check-out procedures when they are shared, and <br />(f} Taking frequent inventories <br />(2} When being transported outside of a Secured Area, portable devices and <br />media with DSHS Confidential Information must be under the physical <br />control of Contractor staff with authorization to access the Data. <br />(3) Portable devices include, but are not limited to; smart phones, tablets, <br />flash memory devices (e .g . USS flash drives, personal media players}, <br />portable hard disks, and laptop/notebook/netbook computers if those <br />computers may be transported outside of a Secured Area. <br />(4} Portable media includes, but is not limited to; optical media (e.g. CDs, <br />DVDs}, magnetic media (e.g. floppy disks, tape}, or flash media (e.g. <br />CompactFlash, SD, MMC}. <br />h. Data stored for backup purposes. <br />(1) DSHS data may be stored on portable media as part of a Contractor's <br />existing, documented backup process for business continuity or disaster <br />recovery purposes. Such storage is authorized until such time as that <br />media would be reused during the course of normal backup operations. If <br />backup media is retired while DSHS Confidential Information still exists <br />upon it, such media will be destroyed at that time in accordance with the <br />disposition requirements in Section 5. Data Disposition <br />(2} DSHS Data may be stored on non-portable media (e.g. Storage Area <br />Network drives, virtual media, etc.) as part of a Contractor's existing, <br />documented backup process for business continuity or disaster recovery <br />purposes. If so, such media will be protected as otherwise described in <br />Professional Services Agreement <br />Page 31