Laserfiche WebLink
(a) Encrypt the Data with a key length of at least 128 bits <br />(b) Control access to devices with a Unique User ID and Hardened <br />Password or stronger authentication method such as a physical token <br />or biometrics. <br />(c) Manually lock devices whenever they are left unattended and set <br />devices to lock automatically after a period of inactivity, if this feature is <br />available. Maximum period of inactivity is 20 minutes. <br />Physically Secure the portable device(s) and/or media by <br />(d) Keeping them in locked storage when not in use <br />(e) Using check-in/check-out procedures when they are shared, and <br />(f) Taking frequent inventories <br />(2) When being transported outside of a Secured Area, portable devices and <br />media with DSHS Confidential Information must be under the physical <br />control of Contractor staff with authorization to access the Data. <br />(3) Portable devices include, but are not limited to; smart phones, tablets, <br />flash memory devices (e.g. USB flash drives, personal media players), <br />portable hard disks, and laptop/notebook/netbook computers if those <br />computers may be transported outside of a Secured Area. <br />(4) Portable media includes, but is not limited to; optical media (e.g. CDs, <br />DVDs), magnetic media (e.g. floppy disks, tape), or flash media (e.g. <br />CompactFlash, SD, MMC). <br />h. Data stored for backup purposes. <br />(1) DSHS data may be stored on portable media as part of a Contractor's <br />existing, documented backup process for business continuity or disaster <br />recovery purposes. Such storage is authorized until such time as that <br />media would be reused during the course of normal backup operations. If <br />backup media is retired while DSHS Confidential Information still exists <br />upon it, such media will be destroyed at that time in accordance with the <br />disposition requirements in Section 5. Data Disposition <br />(2) DSHS Data may be stored on non-portable media (e.g. Storage Area <br />Network drives, virtual media, etc.) as part of a Contractor's existing, <br />documented backup process for business continuity or disaster recovery <br />purposes. If so, such media will be protected as otherwise described in <br />Professional Services Agreement <br />Page 32 <br />