Robin H Read FINAL CONTRACT - Laserfiche WebLink

Home Browse Search

Special Terms and Conditions a. Have documented policies and procedures governing access to systems with the shared Data b, Restrict access thro igh administ-ative, physical, and technical coitrols to authorized staff. c. Ensure that user accounts are urique and that any given usar account logon ID and password combination is known only to the one employee to whom that account is assigned. For purposes of non -repudiation, it rrust always be possible -o determine which employee performed a given action on a system housing the Data based solely on the logon ID used ro perform the action d. Ensure that only authorized users are capat:le of accessing the Data. e. Ensure that an emplcyee's access to the Data is removed immediately: (1) Upon suspected compromise of the user credentials. (2) When their employment, or the contract under which 'he Data is made available to them, is terminated. (3) When they no longer need access to the Data to fulfill the requdrements of the contract. f. Have a process to periodically ref, iew and verify that only authorized users have access to systems containing DSHS Co-ifidential Information g. When accessing the Data from within the Co-itractor's network (the Data stays within the Contractor's network at all times), enforce password and logon requirements for users within the Contractor's network, including: (1) A minimum length of 8 characters, and containing at leas"' three of the following character classes: uppercase letters, lowercase letters, numerals, and special characters such as an asterisk, ampersand, or exclamation poin-. (2) That a password does not con-ain a user's name, logcn ID, or any form of their full name. (3) That a password does not consist of a single dictionary word. A password may be formed as a passphrase which consists of multiple dictionary words. (4) That passwords a-e significant y different `rom the previous four passwords. Passwords that increment by simply adding a rumber are not considered significantly different. h. When accessing Confidential Information from an external location (the Data will traverse the Internet or otherwise travel outside the Contractor's network), mitigate risk and enforce password and logon requirements for users by employing measures including-- (1) Ensuring mitigations applied to the system don't allow end -user modification (2) Not allowing the use of dial -up ;onnections. (3) Using industry standard protocols and solutions for remote access. Examples would include RADIUS and Citrix. (4) Encrypting all remote access traffic from tl-e external workstation to Trusted Network or to a component within the Trusted Network. The traffic must be encrypted at all times while traversing any network, including the Internet, which is not a Trusted Network. DSHS Central Contract Services Page 21 1769CS County Agreement 05-15-2023