Final Contract - Laserfiche WebLink

Home Browse Search

(1). Data will not be stored in any consumer grade Cloud solution, unless all of the following conditions are met: (a). Contractor has written procedures in place governing use of the Cloud storage and Contractor attests in writing that all such procedures will be uniformly followed; (b). The Data will be Encrypted while within the Contractor network; (c). The Data will remain Encrypted during transmission to the Cloud; (d). The Data will remain Encrypted at all times while residing within the Cloud storage solution; (e). The Contractor will possess a decryption key for the Data, and the decryption key will be possessed only by the Contractor and/or DCYF; (f). The Data will not be downloaded to non -authorized systems, meaning systems that are not on either the DCYF or Contractor networks; (g). The Data will not be decrypted until downloaded onto a computer or portable devise within the control of an Authorized User and within either the DCYF or Contractor's network; and (h). Access to the cloud storage requires Multi Factor Authentication or Two Step Authentication. (2). Data will not be stored on an Enterprise Cloud storage solution unless either: (a) The Cloud storage provider is treated as any other Sub -Contractor, and agrees in writing to all of the requirements within this exhibit; or (b) The Cloud storage solution used is Fed RAMP certified. (3) If the Data includes protected health information covered by the Health Insurance Portability and Accountability Act (HI PAA), the Cloud provider must sign a Business Associate Agreement prior to Data being stored in their Cloud solution. 8. Method of Transfer. a. All Data transfers to or from the Contractor shall only be made by using the secure data.wa.gov portal provided by the state of Washington with login and hardened password security. b. The Contractor shall use an encrypted email account for electronic submissions which contain Confidential, and Personal Information, as defined in the General Terms and Conditions. Information regarding encrypted email accounts can be obtained at DCYF's website, located at: https://www.dcyf.wa.g ov/services/ch ild-welfare-orovid erste ncrypted-ema i I. 9. System Protection. To prevent compromise of systems which contain DCYF Data or through which that Data passes: a. Systems containing Data must have all security patches or hotfixes applied within three (3) months of being made available; b. The Contractor will have a method of ensuring that the requisite patches and hotfixes have been applied within the required timeframes; C. Systems containing Data shall have an Anti-Malware application, if available, installed; and Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 15