Laserfiche WebLink
7 Authorization, Authentication, and Access. <br />a. ln order to ensure that access to the Data is limited to authorized staff, the Contractor must comply <br />with the following: <br />('l) Have documented policies and procedures that: <br />(a) Govern access to systems; and <br />(b) Govern access to paper/hard copy documents and files. <br />(2) Only allow access to Confidential lnformation through administrative, physical, and technical <br />controls. <br />(3) Ensure that user accounts are unique and that any given useraccount logon lD and password <br />combination is knounr only to the one staff member to whom that account is assigned. For <br />purposes of non-repudiation, it must always be possible to determine which staff member <br />performed a given action on a system housing the Data based solely on the logon lD used to <br />perform the action. <br />(4) Ensure that only authorized users are capable of accessing the Data; <br />(5) Ensure that an employee's access to Data is removed: <br />(a) Within twenty-four (24)hours of an alleged compromise of the usercredentials; <br />(b) Within 24 hours from when their employment, or the contract underwhich the Data is made <br />available to them, is terminated; <br />(c) Within 24 hours from when the employee or contractor no longer need access to the Data to <br />fulfill the requirements of the Contract; and <br />(d) Within 24 hours from wlren the staff member has been suspended from performing services <br />under this Contract. <br />(6) Have a process in place the requires quarterly revieus verifications that ensure only authorized <br />users have access to systems containing confidential lnformation. <br />(7) The Contractor must require the following password and logon requirements for Authorized <br />Users to access Data Wthin the Trusted Network: <br />(a)To access Data the Authorized User must be required to enter a Hardened password; <br />(b)The hardened password must not contain a user's name, logon lD, or any form of an <br />individual's full name; <br />(c)The hardened password must not consist of a single dictionary word. A password may be <br />formed as a passphrase which consists of multiple dictionary words; and <br />(d)Hardened passwords are significantly different from the previous four (4) passwords. <br />Hardened passwords that increment by simply adding a number are nolconsidered <br />sig nificantly d ifferent. <br />Department of Children, Youth & Families <br />2017CF County Program Agreement 6-24-20 Page 1 9