Laserfiche WebLink
Data Sharing Addendum - 13 <br />6.20.23 <br />3. Protection of Confidential Information <br />A) Confidential Information will be encrypted with NIST 800-series approved algorithms. <br />Encryption keys will be stored and protected independently of the Confidential <br />Information. Access to the Confidential Information will be restricted to Authorized Users <br />through the use of access control lists, a Unique User ID, and a Hardened Password, or <br />other authentication mechanisms which provide equal or greater security. Systems which <br />contain or provide access to Confidential Information must be located in an area that is <br />accessible only to authorized personnel, with access controlled through use of a key, card <br />key, combination lock, or comparable mechanism. <br />B) Confidential Information may not be stored on Portable/Removable Media or Devices. <br />C) Any paper records containing Confidential Information must be protected by storing the <br />records in a Secured Area that is accessible only to authorized personnel. When not in use, <br />such records must be stored in a locked container, such as a file cabinet, locking drawer, or <br />safe, to which only authorized persons have access. <br />4. Confidential Information Segregation <br />City’s Confidential Information received under this MDSA must be segregated or otherwise <br />distinguishable from non-City data. This is to ensure that when no longer needed by the <br />Receiving Party, all of City’s Confidential Information can be identified for return or <br />destruction. It also aids in determining whether City’s Confidential Information has or may <br />have been compromised in the event of a security breach. <br />a. City’s Confidential Information must be kept in one of the following ways: <br />i. on media (e.g. hard disk, tape, etc.) which will contain only City Confidential <br />Information; or <br />ii. in a logical container on electronic media, such as a partition or folder dedicated <br />to City’s Confidential Information; or <br />iii. in a database that will contain only City Confidential Information; or <br />iv. within a database and will be distinguishable from non-City data by the value of a <br />specific field or fields within database records; or <br />v. when stored as physical paper documents, physically segregated from non-City <br />data in a drawer, folder, or other container. <br />b. When it is not feasible or practical to segregate City’s Confidential Information from <br />non-City data, then both City’s Confidential Information and the non-City data with which it <br />is commingled must be protected as described in this Exhibit. <br />5. Confidential Information Disposition <br />When the Confidential Information is no longer needed, except as noted below, the <br />Confidential Information must be returned to City or destroyed. Media are to be destroyed <br />using the US Department of Defense 5220.22-M Standard. <br />For City’s Confidential Information stored on network disks, deleting unneeded Confidential <br />Information is sufficient as long as the disks remain in a Secured Area and otherwise meet <br />the requirements listed in Section 3, above. Destruction of the data as outlined in this