Executed ACT and EET Agreement - Laserfiche WebLink

Home Browse Search

(8) Cloud storage (a) Data requires protections equal to or greater than those specified elsewh ere Wthin this Exhibit. (b) Cloud storage of Data is problematic as neither DCYF nor the Contractor has control of the environment in which the Data is stored. For this reason: i. Data must not be stored in any consumer grade Cloud solution, unless all of the following conditions are met: (A) The contractor has written procedures in place governing use of the cloud storage and by signing this contract, the Contractor attests that all such procedures will be uniformly followed; (B)The Data must be Encrypted while within the Contractor network; (C)The Data must remain Encrypted during transmission to the Cloud; (D)The Data must remain Encrypted at all times while residing within the Cloud storage solution ; (E) The Contractor must possess a decryption key for the Data, and the decryption key will be possessed only by the Contractor and/or DCYF; (F)The Data must not be dorirnrloaded to a non-authorized system. the only authorized systems are located on the DCYF network or Trusted networks; (G)The Data must not be decrypted until dorrrrnloaded onto a computer or portable devise within the control of an Authorized User and within either the DCYF network or Trusted network; and (H) Access to the cloud storage requires Multi Factor Authentication. ii. Data must not be stored on an Enterprise Cloud storage solution unless either: (A) The Cloud storage provider is treated as any other Sub-Contraclor, and agrees in uniting to all of the requirements within this exhibit;or (B)The Cloud storage solution used is FedRAMp certified; or (C)Contractor can attest that: 1 . They have reviewed the data security policy of the cloud service provider;and 2. The cloud service provider meets requirements of Exhibit A in full or with limited exceptions. 9. Method ofTransfer (1) Approved options include: Departmentof Children, Youth & Families 2017 CF County Program Agreement 6-24-20 d All Data transfers to or from the Contractor shall be made by using an approved solution that meetsagency and state lT security standards. Page 23