DDA County Services 27582 - Laserfiche WebLink

Home Browse Search

1 Special Terms and Conditions Exhibit A - Data Security Requirements Definitions- The words and phrases listed below, as used in this Exhibit, shall each have the followingdefinitions: a' 'AES" means the Advanced Encryption Standard, a specification of Federal lnformation processing Standards Publications. for the encryption of electronic data issued by the National lnstitute ofStandards and Technology (http://nvipubs.nist.gov/nistpubs/FlpS/NtST.Ffps.igz.poO. b' "Authorized Users(s)" means an individual or individuals with a business need to access DSHSconfidential lnformation, and who has or have been authorized to do so, c' "Category 4 Data" is data that is confidential and requires special handling due to statutes orregulations that require especially strict protection oi the daia and from w[ich lsleciatty seriousconsequences may arise in the event of any compromise of such data. For purpoi"r of thiscontract' data classifig!.g1cateoory 4 refeis to data protected by: the Health lnsurance portability and Accountabitity Act (HtpAA). d' "Cloud" means data storage on servers hosted by an entity other than the Contractor and on anetwork outside the control of the contractor, Physical storage of data in the cloud typically spansmultiple servers and often multiple locations. Ctoud storage tan be divided between consumergrade storage for personal files and enterprise grade for cimpanies and governnrental entities,Examples of consumer grade storage would inc]ude icloud, bropbox, Box.com, and many otherentities. Enterprise cloud vendors include Microsoft Azure, Amazon Web Services, 0365, andRackspace. e' "Encrypt" means to encode Confidential lnformation into a format that can only be read by thosepossessing a "key"; a password, digital certificate or other mechanism availabje only to authorizedusers. Encryption must use a key length of at least 128 bits (256 prererreofroiryrr"tri. keys, or2048 bits for asymmetric keys. whenl symmetric key is used, the AdvanceJ encrvption standard(AES) must be used if available. f' "Hardened Password" means a string of at least eight characters containing at least three of thefollowing four character classes: Up[ercase alphabetic, lowercase alphabetic, numeral, and specialcharacters such as an asterisk, ampersand, or excramaiion point. g' "Mobile Device" means a computing device, typically smaller than a notebook, which runs a mobileoperating system, such as iOS, Android, or Windows Phone. Mobile Devices include smart phones,most tablets, and other form factors. h' "Multi-factor Authentication" means controlling access to computers and other lT resources byrequiring two or more pieces of evidence thaithe user is who they claim to ne. rhlse pieces ofevidence consist of something the user kn9w9, such as a password or plN; something the user hassuch as a key card,.sTat card, or physical token; and something the uu"r" 1., a Uiometric identifiersuch as a fingerprint, facial scan, or retinal scan. "PlN" means a personal identification number, aseries of numbers which act as a password for a device. Since plNs are typically only four to sixcharacters, PlNs are usually used in conjunction with another factor of autnbnticition, such as afingerprint. ' "Portable Device" means any computing device with a smallform factor, designed to be transportedfrom place to place. Porlable devices ale primarily battery powered devices w1n base computingresources in lhe form of a processor, memory, storage, and'network access. Examples inciude,tut DSHS Cenlral Contract Services 1 769CS County Agreement OS-1 6-2023 Page 19