DDA and KCPHD Service Agreement - Laserfiche WebLink

Home Browse Search

Special Terms and Conditions Exhibit A - Data Security Requirements 1 Definitions. The words and phrases listed below, as used in this Exhibit, shall each have the following definitions: a. "AES' means the Advanced Encryption Standard, a specification of Federal lnformation Processing Standards Publications for the encryption of electronic data issued by the National lnstitute of Standards and Technology (http://nvlpubs.nist.gov/nistpubs/FIPS/NlST.FlPS.197.pdfl. b, "Authorized Users(s)" means an individual or individuals with a business need to access DSHS Confidential lnformation, and who has or have been authorized to do so. "Category 4 Data" is data that is confidential and requires special handling due to statutes or regulations that require especially strict protection of the data and from which especially serious consequences may arise in the event of any compromise of such data. For purposes of this contract, data classified as Category 4 refers to data protected by: the Health lnsurance Portability and Accountability Act (HIPAA). d. "Cloud" means data storage on servers hosted by an entity other than the Contractor and on a network outside the control of the Contractor. Physical storage of data in the cloud typically spans multiple servers and often multiple locations. Cloud storage can be divided between consumer grade storage for personal files and enterprise grade for companies and governmental entities. Examples of consumer grade storage would include iCloud, Dropbox, Box.com, and many other entities, Enterprise cloud vendors include Microsoft Azure, Amazon Web Services, 0365, and Rackspace. e "Encrypt" means to encode Confidential lnformation into a format that can only be read by those possessing a "key", a password, digital certificate or other mechanism available only to authorized users. Encryption must use a key length of at least 128 bits (256 preferred) for symmetric keys, or 2048 bits for asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard (AES) must be used if available. f. "Hardened Password" means a string of at least eight characters containing at least three of the following four character classes: Uppercase alphabetic, lowercase alphabetic, numeral, and special characters such as an asterisk, ampersand, or exclamation point. g. "Mobile Device" means a computing device, typically smaller than a notebook, which runs a mobile opgraung system, sucn as tub, /\nqroto, or vvtnoows Fnone. tvtooile uevtces rncruae sman pnones, most tablets, and other form factors. h. "Multi-factor Authentication" means controlling access to computers and other lT resources by requiring two or more pieces of evidence that the user is who they claim to be. These pieces of evidence consist of something the user knows, such as a password or PIN; something the user has such as a key card, smart card, or physicaltoken; and something the user is, a biometric identifier such as a fingerprint, facial scan, or retinal scan. "PlN" means a personal identification number, a series of numbers which act as a password for a device. Since PiNs are typicaiiy oniy fbur to six characters, PlNs are usually used in conjunction with another factor of authentication, such as a fingerprint. "Portable Device" means any computing device with a smallform factor, designed to be transported from place to place. Portable devices are primarily battery powered devices with base computing resources in the form of a processor, memory, storage, and network access. Examples include, but Page 18 DSHS Central Contract Services 1 769CS County Agreement 06-08-2021 c