Ellensburg Licensing 1905 - Laserfiche WebLink

Home Browse Search

ATTACHMENT B - Data Security Requirements 1. Data Classification The classification of the Data shared under this Agreement includes: ❑ Category 1 — Public Information ❑ Category 2 — Sensitive Information ® Category 3 — Confidential Information ❑ Category 4 — Confidential Information Requiring Special Handling 2. Access Security Access to the Data will be restricted to authorized users by requiring a login using a unique user ID and complex password or other authentication mechanism which provides equal or greater security. Passwords must be changed on a periodic basis and the sharing of user ID and passwords is strictly prohibited. 3. Data Storage Subagent agrees that any and all Data will be stored, processed, and maintained solely on designated computing equipment and that at no time will Data be processed on or transferred to any portable storage medium. 4. Data Transmission Subagent agrees that any and all electronic transmissions or exchanges of system and application Data with DOL and/or any other parties expressly designated by DOL shall take place via secure means. Data that is transferred by and/or resides on assigned DOL equipment is considered secure. 5. Distribution of Data Subagent shall ensure no Data of any kind shall be transmitted, exchanged, or otherwise passed to other contractors/vendors or interested parties except on a case-by-case basis as specifically agreed to in writing by DOL. Subagent further agrees not to release, outside their control, screen prints or other printed documents that are not designated for the customer. All hard copies not necessary for business use must be destroyed as referenced in the Data Disposal section. 6. Data Disposal Unless otherwise specified in the Agreement, Subagent agrees that upon termination of this Agreement it shall erase, destroy, and render unrecoverable all Data and certify in writing that these actions have been completed within 30 days of the termination of this Agreement or within 7 days of the request of a Subagent of DOL, whichever shall come first. At a minimum, media sanitization is to be performed according to the standards enumerated by NIST SP 800-88 Guidelines for Media Sanitization. 7. Security Breach Notification Subagent agrees to comply with all applicable laws that require the notification of individuals in the event of unauthorized release of DOL data or other event requiring notification. In the event of a breach of any of Subagent's security obligations, or other event requiring notification under applicable law, Subagent agrees to the following: a) Notify DOL and Agent by telephone and e-mail of such an event within 24 hours of discovery: DOL Help Desk, phone: (360) 902-0111; email: hlbhelp@dol.wa.gov b) Assume responsibility for costs and for cooperating with DOL on all matters necessary for informing all such individuals, as directed by DOL, and in accordance with applicable state and federal laws. c) Mitigate the risk of loss and comply with any notification or other requirements imposed by law or DOL. County Agent/Subagent Contract: Page 24 of 28 County VLO #VO1905 Version: January 2020 Attachment B — Data Security Requirements