Laserfiche WebLink
Special Terms and Conditions <br />are not limited to, mobile phones, tablets, and laptops. Mobile Device is a subset of Portable <br />Device. <br />"Portable Media" means any machine readable media that may routinely be stored or moved <br />independently of computing devices. Examples include magnetic tapes, optical discs (CDs or <br />DVDs), flash memory (thumb drive) devices, external hard drives, and internal hard drives that have <br />been removed from a computing device. <br />k. "secure Area" means an area to which only authorized representatives of the entity possessing the <br />Confidential lnformation have access, and access is controlled through use of a key, card key, <br />combination lock, or comparable mechanism. Secure Areas may include buildings, rooms or <br />locked storage containers (such as a filing cabinet or desk drawer)within a room, as long as access <br />to the Confidential lnformation is not available to unauthorized personnel. ln othenruise Secure <br />Areas, such as an office with restricted access, the Data must be secured in such a way as to <br />prevent access by non-authorized staff such as janitorial or facility security staff, when authorized <br />Contractor staff are not present to ensure that non-authorized staff cannot access it. <br />"Trusted Network" means a network operated and maintained by the Contractor, which includes <br />security controls sufficient to protect DSHS Data on that network. Controls would include a firewall <br />between any other networks, access control lists on networking devices such as routers and <br />switches, and other such mechanisms which protect the confidentiality, integrity, and availability of <br />the Data. <br />m. "Unique User lD" means a string of characters that identifies a specific user and which, in <br />conjunction with a password, passphrase or other mechanism, authenticates a user to an <br />information system. <br />Authority. The security requirements described in this document reflect the applicable requirements of <br />policies and standards of the Washington Technology Services Agency <br />rcte ?combine=&field ries id=80&field t <br />and of the DSHS lnformation Security Policy and Standards Manual. Reference material related to <br />these requirements can be found here: https:i/www.dshs.wa.qovlffa/keepinq-dshs-client-information- <br />private-and-secure, which is a site developed by the DSHS lnformation Security Office and hosted by <br />DSHS Central Contracts and Legal Services. <br />3. Administrative Controls. The Contractor must have the following controls in place <br />a. A documented security policy governing the secure use of its computer network and systems, and <br />which defines sanctions that may be applied to Contractor staff for violating that policy. <br />b. lf the Data shared under this agreement is classified as Category 4 data, the Contractor must be <br />aware of and compliant with the applicable legal or regulatory requirements for that Category 4 <br />Data. <br />c. lf Confidential lnformation shared under this agreement is classified as Category 4 data, the <br />Contractor must have a documented risk assessment for the system(s) housing the Category 4 <br />Data. <br />Authorization, Authentication, and Access. ln order to ensure that access to the Data is limited to <br />authorized staff, the Contractor must: <br />DSHS Central Contract Services <br />1 769CS County Agreement (05-06-2025) <br />2 <br />4 <br />Page 20