i-ACT agreement - Laserfiche WebLink

Home Browse Search

8. Special Terms and Conditions (a). Contractor has written procedures in place governing use of the Cloud storage and Contractor attests in writing that all such procedures will be uniformly followed; (b). The Data will be Encrypted while Wthin the Contractor network; (c). The Data will remain Encrypted during transmission to the Cloud; (d).The Data will remain Encrypted at alltimes while residing within the Cloud storage solution; (e). The Contractor will possess a decryption key for the Data, and the decryption key will be possessed only by the Contractor and/or DCyF; (f1. The Data will not be downloaded to non-authorized systems, meaning systems that are not on either the DCYF or Contractor networks; (g).The Data will not be decrypted until downloaded onio a computer or portable devise within the control of an Authorized User and within either the DCYF or Contractor's network; and (h).Access to the cloud storage requires Multi Factor Authentication or Two Step Authentication. (2). Data will not be stored on an Enterprise Cloud storage solution unless either: (a) The Cloud storage provider is treated as any other Sub-Contractor, and agrees in writing to all of the requirements within this exhibit; or (b) The Cloud storage solution used is FedRAMp certified. (3) lf the Data includes protected health information covered by the Health lnsurance portability and Accountability Act (HIPAA), the Cloud provider must sign a Business Associate Agreement prior to Data being stored in their Cloud solution. Method of Transfer. a. All Data transfers to or from the Contractor shall only be made by using the secure data.wa.gov portal provided by the state of Washington with login and hardened password security. b. The Contractor shall use an encrypted email account for electronic submissions which contain Confidential, and Personal lnformation, as defined in the GeneralTerms and Conditions. lnformation regarding encrypted email accounts can be obtained at DCYF's website, located at: https:l/w\q ff.devf.wa.qov/fiervices/chil$-welfar*-ptp*vid*I*lenSrypted*enrnil. System Protection. To prevent compromise of systems which contain DCYF Data or through which that Data passes: a. Systems containing Data must have all security patches or hotfixes applied within three (3) months of being made available; b. The Contractor will have a method of ensuring that the requisite patches and hotfixes have been applied within the required timeframes; c. Systems containing Data shall have an Anli-Malware application, if available, installed, and d. Anti-Malware software shall be kept up io date. The product, its anti-virus engine, and any malware database the system uses, will be no more than one update behind current. I Depadment of Children, Youth & Families 2O17CF County Program Agreement d24-2O Page 14