SHJ26-007 DOC 1 FOR 1 COMPACT - PARTIALLY EXECUTED

Home Browse Search

ATTACHMENT A HIPAA AND DATA SECURITY REQUIREMENTS by the National Institute of Standards and Technology (NIST). Within 72 hours of a request from DOC, Contractor must provide documentation showing how the credentials are secured during all transmissions using encrypted sessions such as TLS or IPSec, and in storage using a secure hash method validated by the National Institute of Standards and Technology (NIST). i. Passwords or PIN codes may meet a lesser standard if used in conjunction with another authentication mechanism, such as a biometric (fingerprint, face recognition, iris scan) or token (software, hardware, smart card, etc.) in that case: (1) The PIN or password must be at least 5 letters or numbers when used in conjunction with at least one other authentication factor (2) Must not be comprised of all the same letter or number (11111, 22222, aaaaa, would not be acceptable) (3) Must not contain a "run" of three or more consecutive numbers (12398, 98743 would not be acceptable) j. If the contract specifically allows for the storage of Confidential Information on a Mobile Device, passcodes used on the device must: (1) Be a minimum of six alphanumeric characters. (2) Contain at least three unique character classes (upper case, lower case, letter, number). (3) Not contain more than a three consecutive character run. Passcodes consisting of 12345, or abcd12 would not be acceptable. k. Render the device unusable after a maximum of 10 failed logon attempts. I. Ensure the system/service supports single sign -on for state government employees, and external users by integrating the system's authentication mechanisms with the Washington State Enterprise Active Directory and Secure Authentication Gateways (post listeners are typically used for processing the gateway host headers). m. Utilize application authentication controls that are consistent with those described in the most recent version of NIST SP 800-63 for information requiring assurance level 2 or higher. 5. Protection of Data. The Contractor agrees to store Data on one or more of the following media and protect the Data as described: a. Hard disk drives. For Data stored on local workstation hard disks, access to the Data will be restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. b. Network server disks. For Data stored on hard disks mounted on network servers and made available through shared folders, access to the Data will be restricted to Washington State K14078 Page 13 of 19 Department of Corrections Attachment A 26RAD