i-ACT program agreement - Laserfiche WebLink

Home Browse Search

a. All federal and state laws and regulations, as currently enacted or revised, regarding the protection, security, and electronic interchange of Confidential lnformation, Data, Category 4 Data, Sensitive Personal lnformation, and Materials; and b. All federal and state laws and regulations, as currently enacted or revised, regarding the use, disclosure, modification or loss of Confidential lnformation, Data, Category 4 Dala, Sensitive Personal lnformation, and Materials. 5. Administrative Controls. The Contractor must have the following controls in place: a. A documented security policy governing the secure use of its computer network, mobile devices, portable devices, as well as, any form of paper/hard copy documents, and which defines sanctions that may be applied to Contractor staff for violating that policy. b. Security awareness training for all staff, presented annually, as follows: (1). Contractor staff responsibilities under the Contractor's security policy, (2). Contactor staff responsibilities as outlined under contract Exhibit A; and (3). Must successfully complete the DCYF lnformation Security Awareness Training, which can be taken on this web page: httpq:l/W-Wyv,dqvf.wA.govisitggldelault/files/pdf/Sgcuritv.:in-Contracts.pdl 6. Authorization, Authentication, and Access. ln order to ensure that access to the Data is limited to authorized staff, the Contractor must: a. Have documented policies and procedures that: (1). Govern access to systems; and (2). Govern access to paper/hard copy documents and files. b. Restrict access through administrative, physical, and technical controls to authorized staff; c. Ensure that user accounts are unique and that any given user account logon lD and password combination is known only to the one staff member to whom that account is assigned. For purposes of non-repudiation, it must always be possible to determine which stafimember performed a given action on a system housing the Data based solely on the logon lD used to perform the action; d. Ensure that only authorized users are capable of accessing the Data; e. Ensure that an employee's access to Data is removed within twenty-four (24) hours: (1). Upon suspected compromise of the user credentials; (2). When their employment, or the contract under which the Data is made available to them, is terminated; (3).When they no longer need access to the Data to fulfillthe requirements of the Contract; and (a), when the staff member has been suspended from performing services under this Contract. f. Have a process to review and verify, quarterly, that only authorized users have access to systems Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 11