Fully Executed Contract - Laserfiche WebLink

Home Browse Search

5. ATTA,CHMENT A HlP,iqA AND DATA SECURITY REOUIREMENTS by the National lnstitute of Standards and Technotogy (NIST). Within 72 hours of a request from DOG, Contractor must provide documentation showing how the credentials are secured during alltransmissions using encrypted sessions such as TLS or lPSec, and in storage using a secure hash method validated by the National tnstitute of Standards and Technology (NIST). Passwords or PIN codes may meet a lesser standard ff used in conjunction with another authentication mechanism, such as a biometric (fingerprint, face recognition, iris scan) or token (software, hardware, smart card, etc.) in that case: (1) The PIN or password must be at least 5 letters or numbers when used in conjunction with at least one other authentication factor (2) Must not be comprised of all the same letter or number (111'11,22222, aaaaa, would not be acceptable) (3) Must not contain a "run" of three or more consecutive numbers (12398, 98743 would not be acceptable) j. lf the eontract specifically allows forthe storage of Confidential lnformation on a Mobile Device, passcodes used on the device must: (1) Be a minimum of six alphanurneric characters. (2) Contain at least three unique character classes (upper case, lower case, letter, number). (3) Not contain more than a three consecutive character run. Passcodes consisting of 12345, or abcd12 would not be acceptable. k. Render the device unusable after a maximum of 10 failed logon attempts. Ensure the system/service supports single sign-on for state government employees, and external users by integrating the system's authentication mechanisms with the Washington State Enterprise Active Directory and $ecure Authentication Gateways (post listeners are typically used for processing the gateway host headers). m. Utilize application authentlcation controls that are consistent with those described in the most receni version of NIST SP 800-63 for information requiring assurance level 2 or higher. Protection of Data, The Contractor agrees to store Data on one or more of the following media and protect the Data as described: a, Hard disk drives. For Data stored on localworkstation hard disks, access to the Data will be restricted to Authorized Use(s) by requiring logon to the localworkstation using a Unique User lD and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards, b. Network server disks. For Data stored on hard disks mounted on network seryers and made available through shared folders, access to the Data will be restricted to Washingion State Department of Cortections Kl4078 Attachment A Page 13 of 19 26RAD