Kittitas County.2363-49714.ACT and EET Quality Assurance with Judge's Signature

Home Browse Search

(8) When accessing Confidential Information and Data from an external location (the Data will traverse the Internet or otherwise travel outside the Trusted network), mitigate risk and enforce hardened password and logon requirements for users by employing measuresthat include: (a) Ensuring mitigations applied to the system don't allow end -user modification; (b) Not allowing the use of dial -up connections; (c) Using industry standard protocols and solutions for remote access. Examples include secure VPN and Citrix; (d) Encrypting all remote access traffic from the external workstation to Trusted Network or to a component within the Trusted Network. The traffic must be encrypted at all times while traversing any network, including the Internet, which is not a Trusted Network; (e) Ensuring that the remote access system prompts for re -authentication or performs automated session termination after no more than thirty (30) minutes of inactivity; and (f) Ensuring the use of Multi -Factor Authentication (MFA) to connect from the external end point to the internal end point. (9) Hardened passwords or PIN codes may meet a lesser standard if used in conjunction with another authentication mechanism, such as a biometric (fingerprint, face recognition, iris scan) or token (software, hardware, smart card, etc.). If a lesser standard is authorized underthis subsection, the PIN or password must: (a) Be at least five (5) letters or numbers when used in conjunction with at least one other authentication factor; (b) Not be comprised of all the same letter or number (11111, 22222, aaaaa, would not be acceptable); and (c) Not contain a "run" of three or more consecutive numbers (12398, 98743 would not be acceptable). (10) If the Contract specifically allows for the storage of Confidential Information on a Portable Device, passwords used on the device must: (a) Be a minimum of six (6) alphanumeric characters; (b) Contain at least three unique character classes (uppercase, lower case, letter, number); (c) Not contain more than a three consecutive character run. Passcodes consisting of (12345, or abcd12 would not be acceptable); and (d) Render the device unusable after a maximum of five (5) failed logon attempts. 8. Protection of Data. a. The Contractor agrees to store Data on one or more of the following medial and protectthe Data as described: (1) Hard disk drives Department of Children, Youth & Families 2017CF County Program Agreement 6-24-20 Page 20