Final Contract - Laserfiche WebLink

Home Browse Search

a. All federal and state laws and regulations, as currently enacted or revised, regarding the protection, security, and electronic interchange of Confidential Information, Data, Category 4 Data, Sensitive Personal Information, and Materials; and b. All federal and state laws and regulations, as currently enacted or revised, regarding the use, disclosure, modification or loss of Confidential Information, Data, Category 4 Data, Sensitive Personal Information, and Materials. 5. Administrative Controls. The Contractor must have the following controls in place: a. A documented security policy governing the secure use of its computer network, mobile devices, portable devices, as well as, any form of paper/hard copy documents, and which defines sanctions that may be applied to Contractor staff for violating that policy. b. Security awareness training for all staff, presented annually, as follows: (1). Contractor staff responsibilities under the Contractor's security policy; (2). Contactor staff responsibilities as outlined under contract Exhibit A; and (3). Must successfully complete the DCYF Information Security Awareness Training, which can be taken on this web page: https //www dcyf wagov/sites/default/files/pdf/Security-in-Contracts pdf Authorization, Authentication, and Access. In order to ensure that access to the Data is limited to authorized staff, the Contractor must: a. Have documented policies and procedures that: (1). Govern access to systems; and (2). Govern access to paper/hard copy documents and files. b. Restrict access through administrative, physical, and technical controls to authorized staff; c. Ensure that user accounts are unique and that any given user account logon ID and password combination is known only to the one staff member to whom that account is assigned. For purposes of non -repudiation, it must always be possible to determine which staff member performed a given action on a system housing the Data based solely on the logon ID used to perform the action; d. Ensure that only authorized users are capable of accessing the Data; e. Ensure that an employee's access to Data is removed within twenty-four (24) hours: (1). Upon suspected compromise of the user credentials; (2). When their employment, or the contract under which the Data is made available to them, is terminated; (3). When they no longer need access to the Data to fulfill the requirements of the Contract; and (4). When the staff member has been suspended from performing services under this Contract. f. Have a process to review and verify, quarterly, that only authorized users have access to systems Deparhnent of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 11