|
Special Terms and Conditions
<br />i. "Mobile Device" means a computing device, typ ically smaller than a notebook , which r uns a m0bile
<br />operating syste m, such as 1OS, And roid , or Win dows Phone . Mobile Devices include smart'phones ,
<br />most tablets , and other form factors.
<br />j. "Multi-factor Authentication" means controlling access to computers and other IT resources by
<br />requiring two or more pieces of evidence that the user is who they claim to be . These pieces of
<br />evidence consist of something the user knows , such as a password or PIN; something the user has
<br />such as a key card, smart card, or physical token; and something the user is, a biometric identifier
<br />such as a fingerprint, facial scan, or retina l scan. "PIN" means a personal identificati on number, a
<br />series of numbers which act as a password for a device. Since PINs are typically only four to six
<br />characters, PINs are usually used in conjunction with another factor of authentication, such as a
<br />fingerprint.
<br />k. "Portable Device" means any computing device with a small form factor, desi gned to be transported
<br />fr0m place t0 place. Portable devices are primarily b~ttery powered devices with base computing
<br />resources in the form of a processor, memory, storage, and network access. Ex amples include, but
<br />are not limited to , mobi le phones, tablets, arid laptops. Mobile Device is a subset of Portable
<br />Device.
<br />I. "Portable Media" means any machine readable media that may routinely be stored or moved
<br />independently of computing devices. Examples include magnetic tapes, optical discs (CDs or
<br />DVDs), flash memory (thumb drive) devices, external hard drives, and internal hard drives that
<br />have been removed from a computing device.
<br />m. "Secure Area " means an area to which only authorized representatives of the entity possessin g the
<br />Confidential l hformatlon have access, and access is controlled throu·gh use of a key, card key,
<br />combination lock, or comparable mechanism. Secure Areas may Include buildings, rooms or
<br />locked storage containers (such as a filing cabi net or desk drawer) within a room, as long as
<br />acces s to the Confid ential Informati on is not available to unauthorized personnel. In otherwise
<br />Secure Areas, such as an offite wit h restri cted access , the Data must be secured in such a way as
<br />to pre vent access by non -authorized staff such as ja nitorial or fa cility security staff, when
<br />autho rized Contracto r staff are not present to ensure that non-authorized staff cannot access it.
<br />n. "Trusted Network" means a network operated and maintained by the Contractor, which includes
<br />security controls sufficient to protect DSHS Data on that network. Controls would include a firewall
<br />between any other networks, access control lists on networking devices such as routers and
<br />switches, and other such mechanisms wh ich protect the confidentiality, integrity, and availabil ity of
<br />the Data .
<br />o. "Unique User ID" means a string of cha racters that identifies a specific user and which, in
<br />co njunction with a password, passphrase or other mechanism , authenticates a user to an
<br />information system.
<br />2 . Authority. The security requirements described in this document reflect the applicable requ irements
<br />of Standard 141 .10 (https://ocio:wa .gov/policies ) of the Office of the Chief Information Officer for the
<br />state of Washington , and of the DSHS Information Security Policy and Standards Manual. Reference
<br />material related to these r equirements can be found here: https://www.dsbs.wa .gov/fsa/central-
<br />contract-services/keeplng -dshs-client-information-private-and-se.cure, wh ich is a site developed by the
<br />DSHS Information Security Office and hosted by DSHS Central Contracts and Leg-al Services .
<br />3. Administrative Controls. The Contractor must have the following controls in place :
<br />a. A documented securi ty policy governing the secure use of its computer network and systems, and
<br />DSHS Central Contract Services
<br />5048CF County Program Agreement (11-22-2011 ) Pa ge 7
|