Laserfiche WebLink
a) If so authorized the data must be encrypted during transmissions using a key <br />length of at least 128 bits. Industry standard mechanisms and algorithms, such <br />as those validated by the National Institute of Standards and Technology <br />(NIST) are required. <br />b) Authentication must occur using a unique user ID and Complex Password (of <br />at least 8 characters). When the data is classified as Confidential or Restricted, <br />authentication requires secure encryption protocols and multi -factor <br />authentication mechanisms, such as hardware or software tokens, smart <br />cards, digital certificates or biometrics. <br />c) Accounts must lock after 5 unsuccessful access attempts, and remain locked <br />for at least 15 minutes, or require administrator reset. <br />F. Data storage on mobile devices or portable storage media <br />1. Examples of mobile devices are: smart phones, tablets, laptops, notebook or netbook <br />computers, and personal media players. <br />2. Examples of portable storage media are: flash memory devices (e.g. USB flash drives), and <br />portable hard disks. <br />3. The data must not be stored by the Information Recipient on mobile devices or portable <br />storage media unless specifically authorized within the terms of this Agreement. If so <br />authorized: <br />a) The devices/media must be encrypted with a key length of at least 128 bits, using <br />industry standard mechanisms validated by the National Institute of Standards and <br />Technologies (NIST). <br />• Encryption keys must be stored in a secured environment that is separate from <br />the data and protected in the same manner as the data. <br />b) Access to the devices/media is controlled with a user ID and a Complex Password (of <br />at least 6 characters), or a stronger authentication method such as biometrics. <br />c) The devices/media must be set to automatically wipe or be rendered unusable after <br />no more than 10 failed access attempts. <br />d) The devices/media must be locked whenever they are left unattended and set to lock <br />automatically after an inactivity activity period of 3 minutes or less. <br />e) The data on these mobile devices/media must not be stored in the Cloud. This <br />includes device backups. <br />Page 22 of 26 <br />09/2017 <br />