Laserfiche WebLink
DOL Contract No. K4666 <br /> 9 DOL Account No. 911154 <br /> Contractor Contract No. <br /> 4. IT Security Policies and Procedures: Contractor shall maintain and enforce information <br /> technology security policies and procedures consistent with this Contract, and provide an <br /> electronic copy to DOL upon request within three(3) business days. Contractor's <br /> information technology security policies and procedures shall include a computer incident <br /> response policy and procedure and annual security training to its employees. <br /> 5. Protection/Intrusion Devices: All Contractors' information technology assets that <br /> store/process DOL Data shall be physically secured from unauthorized access. Contractor <br /> shall employ adequate devices such as Intrusion Protection (IPS) and Intrusion Detection <br /> (IDS)devices and system log monitoring to ensure unauthorized users cannot access <br /> Contractor information technology assets in a manner that allows DOL Data to be <br /> compromised. <br /> 6. Periodic Vulnerability Scanning and Penetration Testing: Contractor shall periodically scan <br /> information technology hosts and networks that process DOL Data for vulnerabilities to <br /> exploitation. This is a utility that will look at your system to determine if there are <br /> weaknesses. <br /> 7. Self Audits: Contractor agrees to conduct an annual internal and independent audit to <br /> review Contractor's data protection, access and appropriate use. These audits shall be <br /> conducted at the Contractor's expense. The Contractor agrees to provide DOL with <br /> copies of each audit and the results of each audit within thirty(30) days of audit <br /> completion or upon request. <br /> DA-TA-GLA-SSIFYC—A-TI-ON--DECL-ARA-TION <br /> Data described in this data sharing Agreement is assessed to be in the following data <br /> classification: <br /> Confidential Information Requiring Special Handling <br /> Confidential information requiring special handling is information that is specifically <br /> protected from disclosure by law and for which: <br /> a. Especially strict handling requirements are dictated, such as by statutes, <br /> regulations, or agreements. <br /> b. Serious consequences could arise from unauthorized disclosure, such as threats <br /> to health and safety, or legal sanctions. <br /> ACCESS TO DATA <br /> Method of Access/Transfer <br /> The data shall be provided by the DOL using secureAccess Washington. <br /> Frequency of Data Exchange <br /> Repetitive: Continual as needed basis. <br /> Authorized Access to Data <br /> Access to "Confidential"or"Restricted Confidential" information is limited to individual agency <br /> staff and business partners who are specifically authorized and who have a business need-to- <br /> know. In accordance with the terms contained herein and prior to making the data available,the <br /> USER shall notify all staff with access to the data of the use and disclosure requirements. <br /> USER will be responsible for ensuring that all employees obtaining access to the DAPS <br /> application have reviewed this contract and signed the DAPS Appropriate Use Declaration form <br /> incorporated herein by reference. This form will be kept on file at the USER's location. <br /> File Name:K4666 Page 9 of 14 4/9/2013 <br /> Statement of Work,Attachment A <br /> 52 <br />