Laserfiche WebLink
destroyed at that time in accordance with the disposition requirements <br />below in Section 8 Data Disposition. <br />(2) Data may be stored on non -portable media (e.g. Storage Area Network <br />drives, virtual media, etc.) as part of a Lead/sub grantee's existing, <br />documented backup process for business continuity or disaster recovery <br />purposes. If so, such media will be protected as otherwise described in <br />this exhibit. If this media is retired while DSHS Confidential Information <br />still exists upon it, the data will be destroyed at that time in accordance <br />with the disposition requirements below in Section 8 Data Disposition. <br />Cloud storage. DSHS Confidential Information requires protections equal to or <br />greater than those specified elsewhere within this exhibit. Cloud storage of Data <br />is problematic as neither DSHS nor the Lead/sub grantee has control of the <br />environment in which the Data is stored. For this reason: <br />(1) DSHS Data will not be stored in any consumer grade Cloud solution, <br />unless all of the following conditions are met: <br />(a) Lead/sub grantee has written procedures in place governing use <br />of the Cloud storage and Contractor attests in writing that all such <br />procedures will be uniformly followed. <br />(b) The Data will be Encrypted while within the Lead/sub grantee <br />network. <br />(c) The Data will remain Encrypted during transmission to the Cloud. <br />(d) The Data will remain Encrypted at all times while residing within <br />the Cloud storage solution. <br />(e) The Lead/sub grantee will possess a decryption key for the Data, <br />and the decryption key will be possessed only by the Lead/sub <br />grantee and/or DSHS. <br />(f) The Data will not be downloaded to non -authorized systems, <br />meaning systems that are not on either the DSHS or Lead/sub <br />grantee networks. <br />(g) The Data will not be decrypted until downloaded onto a computer <br />within the control of an Authorized User and within either the <br />DSHS or Lead/sub grantee's network. <br />(2) Data will not be stored on an Enterprise Cloud storage solution unless <br />either: <br />(a) The Cloud storage provider is treated as any other Sub - <br />Contractor, and agrees in writing to all of the requirements within <br />this exhibit; or, <br />(b) The Cloud storage solution used is Fed RAMP certified. <br />(3) If the Data includes protected health information covered by the Health <br />Insurance Portability and Accountability Act (HIPAA), the Cloud provider <br />must sign a Business Associate Agreement prior to Data being stored in <br />their Cloud solution. <br />6. System Protection. To prevent compromise of systems which contain DSHS Data or <br />through which that Data passes: <br />a. Systems containing DSHS Data must have all security patches or hotfixes applied <br />W <br />