Laserfiche WebLink
accessible only to authorized personnel, with access controlled through use of a key, card <br />key, combination lock, or comparable mechanism. <br />d. Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers. Data provided by <br />DSHS on optical discs which will be attached to network servers and which will not be <br />transported out of a Secured Area. Access to Data on these discs will be restricted to <br />Authorized Users through the use of access control lists which will grant access only after <br />the Authorized User has authenticated to the network using a Unique User ID and Hardened <br />Password or other authentication mechanisms which provide equal or greater security, such <br />as biometrics or smart cards. Data on discs attached to such servers must be located in an <br />area which is accessible only to authorized personnel, with access controlled through use of <br />a key, card key, combination lock, or comparable mechanism. <br />e. Paper documents. Any paper records must be protected by storing the records in a Secured <br />Area which is only accessible to authorized personnel. When not in use, such records must <br />be stored in a locked container, such as a file cabinet, locking drawer, or safe, to which only <br />authorized persons have access. <br />f. Remote Access. Access to and use of the Data over the State Governmental Network (SGN) <br />or Secure Access Washington (SAW) will be controlled by DSHS staff who will issue <br />authentication credentials (e.g. a Unique User ID and Hardened Password) to Authorized <br />Users on Contractor staff. Contractor will notify DSHS staff immediately whenever an <br />Authorized User in possession of such credentials is terminated or otherwise leaves the <br />employ of the Contractor, and whenever an Authorized User's duties change such that the <br />Authorized User no longer requires access to perform work for this Contract <br />g. Data storage on portable devices or media. <br />(1) Except where otherwise specified herein, DSHS Data shall not be stored by the <br />Contractor on portable devices or media unless specifically authorized within the terms and <br />conditions of the Contract. If so authorized, the Data shall be given the following <br />protections: <br />(a)Encrypt the Data with a key length of at least 128 bits <br />(b)Control access to devices with a Unique User ID and Hardened Password or stronger <br />authentication method such as a physical token or biometrics. <br />(c)Manually lock devices whenever they are left unattended and set devices to lock <br />automatically after a period of inactivity, if this feature is available. Maximum period of <br />inactivity is 20 minutes. <br />Physically Secure the portable device(s) and/or media by <br />(d)Keeping them in locked storage when not in use <br />(e)Using check-in/check-out procedures when they are shared, and <br />(f)Taking frequent inventories <br />(2) When being transported outside of a Secured Area, portable devices and media <br />with DSHS Confidential Information must be under the physical control of Contractor staff <br />with authorization to access the Data. <br />(3) Portable devices include, but are not limited to; smart phones, tablets, flash <br />memory devices (e.g. USB flash drives, personal media players), portable hard disks, and <br />laptop/notebook/netbook computers if those computers may be transported outside of a <br />Secured Area. <br />(4) Portable media includes, but is not limited to; optical media (e.g. CDs, DVDs), <br />56 <br />