Fully Executed Contract - Laserfiche WebLink

Home Browse Search

4. WashingtonState Department of Corrections ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS violating that policy. b. Any data center $ecurity controls must meet or exceed those expected by the Federal lnformation Security Management Act (FISMA) for low to moderate impact systems as described in FIPS 199 and 200, and in the most cunent release of National lnstitute of Standards and Technology (NIST) Special Publications SP800- 53, including all other referenced Nl ST publications, c, Contractor warrants that all data collected, processed, routed, and/or stored by or through the service, or third-party service providers, remains at all times within the United Statos, d. lf the Data shared under this agreement is classified as Gategory 4, the Contractor must be aware of and compliant with the applicable legal or regulatory requirements for that Category 4 Data. e. lf Confidential lnformation shared under this agreement is classified as Category 4, the Contractor must have a documented risk asse$sment for the system(s) housing the Category 4 Dafa. Authorization, Authentication, and Acsess. ln order to ensure that access to the Data is limited to authorized statf, the Contractor must: a, Have documented policies and procedures governing access to systems with the shared Data. b. Restrict access through administrative, physical, and technical controls to authorized staff. c. Ensure that user accounts are unique and that any given user account logon lD and password combination is known only to the one employee to whom that account is assigned. For purposes of non-repudiation, it must always be possible to determine which employee performed a given action on a systern housing the Data based solely on the logon lD used to perform the action, d, Ensure that only authorized users are capable of accessing the Data, e. Ensure that an employee's access to the Data is removed immediately (1) Upon suspected cornpromise of the user credentials. (2) When their employment, or the contract under which the Data is made availabb to thern, is terminated. (3) When they no longer need access to the Data to fulfill the requirements of the contract. f. Have a process to periodically review and veriff that only authorized users have access to systems containing DOC Confidential lnformation. K14078 Attachment A Page 11 of 19 26RAD