i-ACT program agreement - Laserfiche WebLink

Home Browse Search

(3). Paper documents will not be secured or stored in a motor vehicle any time a staff member is away from the motor vehicle. (4). Paper documents will be retained in a Secure Area, per the state of Washington records retention req u irements. f. Data storage on podable devices or media ('l). Except where otherwise specified herein, Data shall not be stored by the Contractor on portable devices or media unless specifically authorized within the terms and conditions of the Contract. lf so authorized, the Data shall be given the following protections: (a). Encrypt the Data; and (b). Control access to devices with a Unique User lD and Hardened Password or stronger authentication method such as a physical token or biometrics; and (c). Manually lock devices whenever they are left unattended and set devices to lock automatically after a period of inactivity, if this feature is available. Maximum period of inactivity is fifteen (15) minutes; and (d). Apply administrative and physical security controls to Portable Devices and Portable Media by: i. Keeping them in a Secure Area when not in use; ii. Using check-in/check-out procedures when they are shared; and iii. Taking quarterly inventories. (2).When being transported outside of a SecureArea, Portable Devices and Portable Media with Data must be under the physical control of Contractor staff with authorization to access the Data, even if the Data is encrypted. Portable Devices and Portable Media will not be secured or stored within motor vehicles at any time the staff member is away from the motor vehicle. g. Data stored for backup purposes. (1 ) DCYF Confidential lnformation may be stored on Portable Media as part of a Contractor's existing, documented backup process for business continuity or disaster recovery purposes. Such storage is authorized until such time as that media would be reused during the course of normal backup operations. lf backup media is retired while DCYF Confidential information still exists upon it, refer to Section j2 Dala Disposition. (2) Data may be stored on non-portable media (e.g. Storage Area Network drives, virtual media,etc.) as part of a Contractor's existing, documented backup process for business continuity ordisaster recovery purposes. lf so, such media will be protected as othenvise described inifrisexhibit' lf this media is retired while DCYF Confidential lnformation still exists upon it, refertoSection 12 Data Disposition. h' cloud storage. Data requires protections equal to or greater than those specified elsewhere withinthis exhibit. Cloud storage of Data is problematic as neither DCYF nor the Contractor has control ofthe environment in which the Data is stored. For this reason: Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 14