|
e
<br />Publication 1075 (https://www.irs.gov/pub/irs -pdt/pLO75.pdf); Substance Abuse
<br />and Mental Health Services Administration regulations on Confidentiality of Alcohol
<br />and Drug Abuse Patient Records, 42 CFR Part 2; andlor Criminal Justice lnformation
<br />Services, 28 CFR Part 20.
<br />,,Cloud" means data Storage on servers hosted by an entity other than the
<br />Contractor and on a network outside the control of the Contractor. Physical storage
<br />of data in the cloud typically spans multiple servers and often multiple locations.
<br />Cloud storage can be divided between consumer grade storage for personal files and
<br />enterprise grade for companies and governmental entities. Examples of consumer
<br />grade storage would include iTunes, Dropbox, Box.com, and many other entities'
<br />Enterprise cloud vendors include Microsoft Azure, Amazon Web Services, and
<br />Rackspace.
<br />'.Encrypt" means to encode Confidential lnformation into a format that can only be
<br />read by those possessing a "key"; a password, digital certificate or other mechanism
<br />available only to authorized users. Encryption must use a key length of at least 256
<br />bits for symmetric keys, or 2048 bits for asymmetric keys. When a symmetric key is
<br />used, the Advanced Encryption Standard (AES) must be used if available.
<br />"FedRAMP" means the Federal Risk and Authorization Management Program (see
<br />www.fedramp.gov), which is an assessment and authorization process that federal
<br />government agencies have been directed to use to ensure security is in place when
<br />accessing Cloud computing products and services.
<br />,,Hardened Password" means a string of at least eight characters containing at least
<br />three of the following four character classes: Uppercase alphabetic, lowercase
<br />alphabetic, numeral, and special characters such as an asterisk, ampersand, or
<br />exclamation point.
<br />"Mobile Device" means a computing device, typically smaller than a notebook,
<br />which runs a mobile operating system, such as iOS, Android, or Windows Phone'
<br />Mobile Devices include smart phones, most tablets, and other form factors'
<br />"Multi-factor Authentication" means controlling access to computers and other lT
<br />resources by requiring two or more pieces of evidence that the user is who they
<br />claim to be. These pieces of evidence consist of something the user knows, such as
<br />a password or PIN; something the user has such as a key card, smart card, or
<br />physical token; and something the user is, a biometric identifier such as a
<br />fingerprint, facial scan, or retinal scan. "PlN" means a personal identification
<br />number, a series of numbers which act as a password for a device. Since PlNs are
<br />typically only four to six characters, PlNs are usually used in conjunction with
<br />another factor of authentication, such as a fingerprint.
<br />,.portable Device" means any computing device with a small form factor, designed to
<br />be transported from place to place. Portable devices are primarily battery powered
<br />devices with base computing resources in the form of a processor, memory, storage,
<br />and network access. Examples include, but are not limited to, mobile phones,
<br />tablets, and laptops. Mobile Device is a subset of Portable Device.
<br />"Portable Media" means any machine readable media that may routinely be stored
<br />or moved independently of computing devices' Examples include magnetic tapes,
<br />opticaldiscs (CDs or DVDs), flash memory (thumb drive) devices, external hard
<br />f
<br />ob
<br />h
<br />k
<br />60
|