Kittitas County.2363-49714.ACT and EET Quality Assurance with Judge's Signature

Home Browse Search

Authorization, Authentication, and Access. a. In order to ensure that access to the Data is limited to authorized staff, the Contractor must comply with the following: (1) Have documented policies and procedures that: (a) Govern access to systems; and (b) Govern access to paper/hard copy documents and files. (2) Only allow access to Confidential Information through administrative, physical, and technical controls. (3) Ensure that user accounts are unique and that any given useraccount logon ID and password combination is known only to the one staff member to whom that account is assigned. For purposes of non -repudiation, it must always be possible to determine which staff member performed a given action on a system housing the Data based solely on the logon ID used to perform the action. (4) Ensure that only authorized users are capable of accessing the Data; (5) Ensure that an employee's access to Data is removed: (a) Within twenty-four (24) hours of an alleged compromise of the user credentials (b) Within 24 hours from when their employment, or the contract underwhich the Data is made available to them, is terminated; (c) Within 24 hours from when the employee or contractor no longer need access to the Data to fulfill the requirements of the Contract; and (d) Within 24 hours from when the staff member has been suspended from performing services under this Contract. (6) Have a process in place the requires quarterly reviews verifications that ensure only authorized users have access to systems containing Confidential Information. (7) The Contractor must require the following password and logon requirements for Authorized Users to access Data within the Trusted Network: (a)To access Data the Authorized User must be required to enter a Hardened Password; (b)The hardened password must not contain a user's name, logon ID, or any form of an individual's full name; (c)The hardened password must not consist of a single dictionary word. A password may be formed as a passphrase which consists of multiple dictionary words; and (d)Hardened passwords are significantly different from the previous four (4) passwords. Hardened passwords that increment by simply adding a number are not considered significantly different. Department of Children, Youth & Families 2017CF County Program !Agreement 6-24-20 Page 19