i-ACT program agreement - Laserfiche WebLink

Home Browse Search

containing Confidential lnformation, Data, Category 4 Dala, Sensitive Personal lnformation, or Materials, g. When accessing the Data from within the Contractor's network (the Data stays within the Contractor's network at all times), enforce password and logon requirements for users within the Contractor's network, including: (1).A minimum length of eight (B) characters, and containing at least three of the following character classes: uppercase letters, lowercase letters, numerals, and special characters such as an asterisk, ampersand, or exclamation point; (2).That a password does not contain a user's name, logon lD, or any form of their full name; (3).That a password does not consist of a single dictionary word. A password may be formed as a passphrase which consists of multiple dictionary words; and (4) That passwords are significantly different from the previous four (4) passwords. Passwords that increment by simply adding a number are not considered significantly different. h. When accessing Confidential lnformation, Data, Category 4Dala, Sensitive Personal lnformation, and Materials from an external location (the Data will traverse the lnternet or othenvise travel outside the Contractor's network), mitigate risk and enforce password and logon requirements for users by employing measures that include: (1). Ensuring mitigations applied to the system don't allow end-user modification; (2). Not allowing the use of dial-up connections; (3). Using industry standard protocols and solutions for remote access. Examples would include RADIUS and Citrix, (4). Encrypting all remote access traffic from the external workstation to Trusted Network or to a component within the Trusted Network. The traffic must be encrypted at all times while traversing any network, including the lnternet, which is not a Trusted Network; (5). Ensuring that the remote access system prompts for re-authentication or performs automated session termination after no more than fifteen (15) minutes of inactivity; and (6)' Ensuring use of Multi-Factor Authentication to connect from the external end point to the internal end point. i' Passwords or PIN codes may meet a lesser standard if used in conjunction with another authentication mechanism, such as a biometric (fingerprint, face reiognition, iris scan) or token(software, hardware, smart card, etc.) in that case: (1)'The PIN or password must be at least five (5) letters or numbers when used in conjunction withat least one other authentication factor; (2).Mustnotbecomprisedof allthesameletterornumber (11111,22222,aaaaa,wouldnotbe acceptable); and (3)'Must not contain a "run" of three or more consecutive numbers (1z3g8, 98743 would not beacceptable). Department of Children, youth & Families 2017CF County Program Agreement 6-24-20 Page 12