|
ATTACHMENT A
<br />HIPAA AND DATA SEGURITY REOUIREMENTS
<br />f. "Cloud" rneans data storage on seryers hosted by an entity other than the Contractor
<br />and on a network outside the control of the Contractor, Physical storage of data in the
<br />cloud typically spans multiple servers and often multiple locations. Ctoud storage can
<br />be divided between consumor grade storage for personal files and enterprise grade
<br />for companies and governmental entities, Examples of congurner grade storage would
<br />include iTunes, Dropbox, Box.com, and many other entities, Enterprise cloud vendors
<br />include Microsoft Azure, Amazon Web Services, and Rackspace,
<br />g. "Encrypt" means to encode Confidential lnformation into a format that can only be read
<br />by those possessing a "key"; a password, digital certificate or other mechanism
<br />available only to authorized users. Enoyption must use a key length of at least 256
<br />bits for symmetric keys, or 2M8 bits for asymmetric keys. When a symmetric key is
<br />used, the Advanced Encryption Standard (AE$) must be used if available.
<br />h. "FedRAMP" means the Federal Risk and Authorization Management Program (see
<br />ranrvw,fedramp.gov), which is an assessment and authorization process that federal
<br />government agencies have been directed to use to ensure security is in place when
<br />accessing Gloud computing products and services.
<br />"Hardened Password" means a string of at least eight characters containing at least
<br />three of the following four character classes: Uppercase alphabetic, lowercase
<br />alphabetic, numeral, and special characters such as an asterisk, ampersand, or
<br />exclamation point.
<br />"Mobile Device" means a computing device, typically smaller than a notebook, which
<br />runs a mobile operating system, such as iOS, Android, or Windows Phone. Mobile
<br />Devices include smart phones, most tablets, and other form factors.
<br />k, "Multi-factor Authentication" means controlling access to computers and other lT
<br />resources by requiring two or more pieces of evidence that the u$er is who they claim
<br />to be. These pieces of evidence consist of something the user knows, such as a
<br />password or PIN; something the user has such as a key card, smart card, or physical
<br />token; and something the user is, a biometric identifier such as a fingerprint, facial
<br />scan, or retinal scan. "PlN" means a personal identification number, a series of
<br />numbers which act ag a password for a device. Since PlNs are typically only four to
<br />six characters, PlNs are usually used in conjunction with another factor of
<br />authentication, such as a fingerprint.
<br />l, "Portable Device' means any computing device with a srnallform factor, designed to
<br />be transported from place to place. Portable devices are primarily battery powered
<br />devices with base computing resources in the form of a processor, memory, storage,
<br />and network access. Examples include, but are not limited to, mobile phones, tablets,
<br />and laptops. Mobile Device is a subset of Portable Device,
<br />m. "Portable Media" means any machine readable media that may routinely be stored or
<br />moved independently of computing devices. Examples include magnetic tapes, optical
<br />discs (CDs or DVDs), flash memory (thumb drive) devices, externa[ hard drives, and
<br />internal hard drives that have been removed from a computing device,
<br />Washington State
<br />Department of Correclions
<br />K14078
<br />Attachment A
<br />Page9 ot19
<br />25RAD
|