Laserfiche WebLink
ATTACHMENT A <br />HIPAA AND DATA SECURITY REQUIREMENTS <br />e. The architecture must provide continuous monitoring of both internal and external <br />activity for anomalies and identify, report, and defend against security intrusions before <br />data is compromised. <br />f. Contractor shall conduct penetration tests at least once every 24 months, system <br />vulnerability assessments at least monthly, and application vulnerability assessments <br />prior to the production release of any changes to source code. <br />g. Contractor has implemented application/system development practices consistent <br />with the current version of NIST SP800-64 for low to moderate impact systems, and <br />warrants the software does not contain any of the Open Web Application Security <br />project (OWASP) top 10 vulnerabilities - https://www.owasp.org/index.php/Main Page <br />h. Contractor has a practice of systematic collection, monitoring, alerting, maintenance, <br />retention, and disposal of security event logs and application audit trails. Logs and <br />audit trails are written to an area inaccessible to system users and are protected from <br />editing. At a minimum the logs and audit trails will provide historical details on all <br />transactions within the system that are necessary to reconstruct activities. Including <br />recording; type of event, date, time, account identification and machine identifiers for <br />each logged transaction. Audit and log files can be analyzed by type in order to find <br />emerging issues or trends. Contractor has settings triggering an immediate notification <br />to appropriate system administrators for severe incidents. Logs are secured against <br />unauthorized changes. At a minimum, logs must be retained for a period of 6 months. <br />Data Segregation. <br />a. DOC Data must be segregated or otherwise distinguishable from non-DOC data. This <br />is to ensure that when no longer needed by the Contractor, all DOC Data can be <br />identified for return or destruction. It also aids in determining whether DOC Data has <br />or may have been compromised in the event of a security breach. As such, one or <br />more of the following methods will be used for data segregation. <br />(1) DOC Data will be kept on media (e.g. hard disk, optical disc, tape, etc.) which will <br />contain no non-DOC Data. And/or, <br />(2) DOC Data will be stored in a logical container on electronic media, such as a <br />partition or folder dedicated to DOC Data. And/or, <br />(3) DOC Data will be stored in a database which will contain no non-DOC data. And/or, <br />(4) DOC Data will be stored within a database and will be distinguishable from non- <br />DOC data by the value of a specific field or fields within database records. <br />(5) When stored as physical paper documents, DOC Data will be physically <br />segregated from non-DOC data in a drawer, folder, or other container. <br />b. When it is not feasible or practical to segregate DOC Data from non-DOC data, then <br />both the DOC Data and the non-DOC data with which it is commingled must be <br />protected as described in this exhibit. <br />Washington State K14078 Page 17 of 14 <br />Department of Corrections Attachment A 26iZAD <br />