WA ST Dept of Corrections 9/20/2022

2. Requestor will store the information in an area that is safe from access by unauthorized persons during work hours as well as non-work hours, or when otherwise not in use. 3. Requestor will design,implement,and maintain an information security program designed to meet at least an industry standard ability to protect the information in a manner that prevents unauthorized persons from retrieving the information by means of computer,remote terminal,or other means. 4. Requestor shall take precautions to ensure that only authorized personnel and agents are given access to files containing confidential or sensitive data. 5. Requestor shall take due care and reasonable precautions to protect WADOC Data from unauthorized physical and electronic access. 6. Both parties shall meet or exceed the requirements set forth in the OCIO's policies and standards for data security and access controls to ensure the confidentiality, availability,and integrity of all data accessed. IV. DATA SEGREGATION A. WADOC Data provided pursuant to this Agreement must be segregated or otherwise distinguishable from non-WADOC Data. This requirement ensures that all WADOC Data can be identified for return or destruction upon expiration,termination,or completion of work under this Agreement. It also aids in determining whether WADOC Data has or may have been compromised in the event of a security breach. B. METHODS OF DATA SEGREGATION. 1. Electronic Media. If WADOC Data is stored on electronic media (e.g.,hard disk, optical disc,magnetic tape): a. Such electronic media shall contain only WADOC Data;or b. WADOC Data shall be stored in a partition or folder or other logical container dedicated to WADOC Data; 2. Database. If WADOC Data is stored in a database: a. Such database shall contain only WADOC Data;or b. WADOC Data shall be distinguishable from non-WADOC Data by the value of a specified field or fields within database records. Washington State K12798 Page 5 of 9 Department of Corrections Attachment A