Fully Executed Agreement (2) - Laserfiche WebLink

Home Browse Search

4. SPecial Terms and Conditions a. A documented security policy governing the secure use of its computer network and systems' and which defines sanctions that may n" rppii"Olo Contractor staff foiviolating that policy' b,lftheDatasharedunderthisagreementisc|assrfled3:9:l:.9"'y4,theContractormustbeaware of and compliant with the applicable legai or regulatory requiremLnts for that Category 4 Data' c. lf confidential lnformation shared under this agreement is. ctassified as category 4, the contractor must have a documented risk "rru.r**nt'i"iin"1'ttem(s) housing the Category 4 Daia' Authorization, Authentication, and Access. rn order to ensure that access to the Data is limited to autnorizeO staff, the Contractor musl: a. Have documented poricies and procedures governing access to systems with the shared ljata' b. Restrict access through administraiive, physical' and technical controls to authorized staff' c. Ensure that user accounts are unique and that any given user account logon lD and password combination is known onty to the one #i ;y* i::irll r,at alcount is issigned' For purposes of non-repudiation, it must always be possible io determine wrricn emptoyee performed a given action on a system housing the Data based #il;;l;;togon lo used to perform the action' d. Ensure that only authorized users are capable of accessing the Data' e.Ensurethatanemployee'saccesstotheDataisremovedimmediately: (1) Upon suspected compromise of the user credentials' (2) When their employment, or the contract under which the Data is made available to them, is f terminated (3) when they no longer need access to the Data to fulfill the requirements of the contract' Have a process to periodically review and verify that only authorized users have access to systems "ont"inii"'g DSHS ionfidential lnformation' when accessing the Data from wtthin the contractor's network (the Data stays within the contractor's network at all times), enforce p""*ota and logon requirements for users within the Contractor's network, including (1) A minimum length of 8 characters, and containing at leastthree of thefollowing character ctasses: ,pp"r""."-t;;;=, il;*;r" d;;";r'i-,"i"r", and special characters such as an asterisk, ampersand, or exclamation point' (2) That a password does not contain a user's name' logon lD' or (3) That a password does not consist of a single dictionary word' '"' prttpn?ase wni"n consists of multiple dictionary words' (4)Thatpasswordsaresignificantlydifferentfromthepreviousfourpasswords.Pa increment oy srmply adding a numberci" n"t considered significantly different' when accessing confidential lnformation from an external location (the Data willtraverse the tnternet or otherwise ii"""i "rtiioe the conira;;; ;;Mtrk), mitigate risk and enforce password and logon requirumenil;;; ;;;t; ty employing measures including: h any form of their full name' A password maY be formed as a sswords that DSHS Central Contract Services i'iiiii 6"""tv Ptog'"t Agreemenl (1 0-3 1 -20 1 7) Page '18