Robin H Read FINAL CONTRACT - Laserfiche WebLink

Home Browse Search

Special Terms and Conditions Exhibit A — Data Security RequirementE Definitions The words and phrases listed belcw, as used in this Exhibit, shall each have the following definitions: a. "AES" means the Acvanced Encryption Standard, a specification of Federal Information Processing Standards Publications for the ercryption of electronic data ssued by the National Institute of Standards and Technology (http:.'/nvlpubs.nist.gov/nistPLbsJFIPS/NIST.FIPS.197.pdf). b. "Authorized Users(s;" means an individual o- individuals with a business need to access DSHS Confidential Information, and who has or have been authorized to do so. c. "Category 4 Data" is data that is confidential and requires special -iandling due to statutes or regulations that require especially- strict protection of the data and from which especially serious consequences may arise in the event of any compromise of such Jata. For purposes of this contract, data classified as Category 4 refers to data protected by: the Health Insurance Portability and Accountability Apt (HIPAA). d. "Cloud" means data storage on servers hosted by an entity ether t-ran the Contractor and on a network outside the control of the Contractor. Physical storage of data in the cloud typically spans muitlple servers and often multiple locations. Cloud storage ,an be divided between consumer grade storage for personal files and enterprise grade for companies and governmental entities. Examples of Consumer grade storage would include iClotd. Dropbox. Box.com, and many other entities. Enterprise cloud vendorE include Microsoft Azure, Amazcn Web Services, 0365, and Rackspace. e. "Encrypt" means to eicode Confidential Information into s format tnat can only be read by those possessing a "key", a password, aigital certificate or other mechan sm available only to authorized users. Encryption must use a key length of at least 128 b is (256 preferred) for symmetric keys, or 2048 bits for asymmetric keys, Wren a symmetric key is used, the Advanced Encryption Standard (AES) must be used if available. f. "Hardened Password' means a sbing of at least eight charac,,ers containing at least three of the following four charactE�T classes: Uppercase alphabetic, lowercase alphabetic, numeral, and special characters such as an asterisk, ampersand, cr exclamatio-i point. g. "Mobile Device" mears a computirg device, typically smaller than s notebook, which runs a mobile operating system, such as iOS, Ar-droid, or "indows Phone. Mobile Devices include smart phones, most tablets, and other form factor. h. "Multi -factor Authentication" means controlling access to computers and other IT resources by requiring two or more pieces of evidence that the user is who they claim to be. These pieces of evidence consist of scmething the user knows, such as a password or PIN; something the user has such as a key card, smart card, or physical token; and something tVe user is, a biometric identifier such as a fingerprint, facial scan, or retinal scan. "PIN" means a personal identification number, a series of numbers which act as a pessword fo- a device. Since PINS are typically only four to six characters, PINs are usually used in conjunctiDn with another factor of authentication, such as a fingerprint. i. "Portable Device" means any computing device with a small form factor, designed to be transported from place to place. Fortable devices are primarily battery powered devices with base computing resources in the form of a processor, memory, storage, and network access. Examples include, but DSHS Central Contract Services Page 19 1769CS County Agreement 05-16-2023