Resolution 2025-084 - Laserfiche WebLink

Home Browse Search

Special Terms and Conditions (d) Apply administrative and physical security controls to Portable Devices and Portable Media by: i. Keeping them in a Secure Area when not in use, ii. Using check-in/check-out procedures when they are shared, and iii. Taking frequent inventories. (2) When being transported outside of a Secure Area, Portable Devices and Portable Media with DSHS Confidential lnformation must be under the physical control of Contractor staff with authorization to access the Data, even if the Data is encrypted. h- Data stored for backup purposes. (1) DSHS Confidential lnformation may be stored on Portable Media as part of a Contraclor's existing, documented backup process for business continuity or disaster recovery purposes. Such storage is authorized until such time as that media would be reused during the course of normal backup operations. lf backup media is retired while DSHS Confidential lnformation still exists upon it, such media will be destroyed at that time in accordance with the disposition requirements below in Section B Data Disposition. i2) Data may be stored on non-portable media (e.9. Storage Area Network drives, virtual media, etc.) as part of a Contractor's existing, documented backup process for business continuity or disaster recovery purposes. lf so, such media will be protected as otherwise described in this exhibit. lf this media is retired while DSHS Confidential lnformation stillexists upon it, the data will be destroyed at that time in accordance with the disposition requirements below in Section 8 Data Disposition. i. Cloud storage. DSHS Confidential lnformation requires protections equal to or greater than those specified elsewhere within this exhibit. Cloud storage of Data is problematic as neither DSHS nor the Contractor has control of the environment in which the Data is stored. For ihis reason. (1) DSHS Data will noi be stored in any consumer grade Cloud solution, unless all of the following conditions are met: (a) Contractor has written procedures in place governing use of the Cloud storage and Contractor attests in writing that all such procedures will be uniformly followed. (b) The Data will be Encrypted while within the Contractor network. (c) The Data will remain Encrypted during transmission to the Cloud. (d) The Data will remain Encrypted at all times while residing within the Cloud storage solution- (e) The Contractorwill possess a decryption key forthe Data, and the decryption key will be possessed only by the Contractor and/or DSHS. (f; The Daia will not be downloaded to non-authorized systems, meaning systems that are not on either the DSHS or Contractor networks. (g) The Data will not be decrypted until downloaded onto a computer within the control of an Authorized User and within eitherthe DSHS or Contractor's network. DSF{S Central Contract Services ti01 7CF County Prcgram Agreement {10 31-2017)Page 14