Laserfiche WebLink
3 <br />2. <br />DSHS Central Contract Services <br />1 769CS County Agreement 06-08-2021 <br />Special Terms and Conditions <br />are not limited to, mobile phones, tablets, and laptops. Mobile Device is a subset of Portable <br />Device. <br />j. "Portable Media" means any machine readable media that may routinely be stored or moved <br />independently of computing devices, Examples include magnetic tapes, optical discs (CDs or <br />DVDs), flash memory (thumb drive) devices, external hard drives, and internal hard drives that have <br />been removed from a computing device. <br />k. "Secure Area" means an area to which only aulhorized representatives of the entity possessing the <br />Confidential lnformation have access, and access is controlled through use of a key, card key, <br />combination lock, or comparable mechanism. Secure Areas may include buildings, rooms or <br />locked storage containers (such as a filing cabinet or desk drawer) within a room, as long as access <br />to the Confidential lnformation is not available to unauthorized personnel. ln otherwise Secure <br />Areas, such as an office with restricted access, the Data must be secured in such a way as to <br />prevent access by non-authorized staff such as janitorial or facility security staff, when authorized <br />Contractor staff are not present to ensure that non-authorized staff cannot access it. <br />l, "Trusted Network" means a network operated and maintained by the Contractor, which includes <br />security controls sufficient to protect DSHS Data on that network. Controls would include a firewall <br />between any other networks, access control lists on networking devices such as routers and <br />switches, and other such mechanisms which protect the confidentiality, integrity, and availability of <br />the Data. <br />m. "Unique User lD" means a string of characters that identifies a specific user and which, in <br />conjunction with a password, passphrase or other mechanism, authenticates a user to an <br />information system, <br />Authority. The security requirements described in this document reflect the applicable requirements of <br />Standard 141.10 (https://ocio.wa.qov/policies) of the Office of the Chief lnformation Officer for the state <br />of Washington, and of the DSHS lnformation Security Policy and Standards Manual. Reference <br />material related to these requirements can be found here: https://www.dshs.wa.qov/ffalkeepinq-dshs- <br />qllent-iffgrmation-private-and-secure, which is a site developed by the DSFIS lrformation Security <br />Office and hosted by DSHS Central Contracts and Legal Services. <br />Administrative Controls. The Contractor must have the following controls in place: <br />a. A documented security policy governing the secure use of its computer network and systems, and <br />which defines sanctions that,may be applied to Contractor staff for violating that policy. <br />b. lf the Data shared under this agreement is classified as Category 4 data, the Contractor must be <br />aware of and compliant with the applicable legal or regulatory requirements for that Category 4 <br />Data. <br />c.lf Confidential lnformation shared under this agreement is classified as Category 4 data, the <br />Contractor must have a documented risk assessment for the system(s) housing the Category 4 <br />Data. <br />Authorization, Authentication, and Access. ln order to ensure that access to the Data is limited to <br />authorized staff, the Contractor must: <br />4. <br />Page 19