Laserfiche WebLink
(8) Cloud storage <br />(a) Data requires protections equal to or greater than those specified elsewhere within this <br />Exhibit. <br />(b) Cloud storage of Data is problematic as neither DCYF nor the Contractor has control of <br />the environment in which the Data is stored. For this reason: <br />i. Data must not be stored in any consumer grade Cloud solution, unless all of the <br />following conditions are met: <br />(A) The Contractor has written procedures in place governing use of the Cloud <br />storage and by signing this contract, the Contractor atteststhat all such <br />procedures will be uniformly followed; <br />(B) The Data must be Encrypted while within the Contractor network; <br />(C) The Data must remain Encrypted during transmission to the Cloud; <br />(D) The Data must remain Encrypted at all times while residing within the <br />Cloud storage solution; <br />(E) The Contractor must possess a decryption key for the Data, and the <br />decryption key will be possessed only by the Contractor and/or DCYF; <br />(F) The Data must not be downloaded to a non -authorized system. the only <br />authorized systems are located on the DCYF network or Trusted networks; <br />(G)The Data must not be decrypted until downloaded onto a computer or <br />portable devise within the control of an Authorized User and within either <br />the DCYF network or Trusted network; and <br />(H) Access to the cloud storage requires Multi Factor Authentication. <br />ii. Data must not be stored on an Enterprise Cloud storage solution unless either: <br />(A) The Cloud storage provider is treated as any other Sub -Contractor, and <br />agrees in writing to all of the requirements within this exhibit; or <br />(B) The Cloud storage solution used is Fed RAMP certified; or <br />(C) Contractor can attest that: <br />1. They have reviewed the data security policy of the cloud service <br />provider; and <br />2. The cloud service provider meets requirements of Exhibit A in full or <br />with limited exceptions. <br />9. Method of Transfer <br />a. All Data transfers to or from the Contractor shall be made by using an approved solution that meets <br />agency and state IT security standards. <br />(1) Approved options include: <br />Department of Children, Youth & Families <br />2017CF County Program Agreement 6-24-20 Page 23 <br />