2023/10/25 Council Agenda Packet

Agency DSA 22-01 DSA Agreement between Agency and SAO Agency DSA: 22-01 “Data Access” refers to rights granted to SAO employees to directly connect to Agency systems, networks and/ or applications combined with required information needed to implement these rights. “Data Transmission” refers to the methods and technologies to be used to move a copy of the data between systems, networks and/ or employee workstations. “Data Storage” refers to the place data is in when at rest. Data can be stored on removable or portable media devices such as a USB drive or SAO managed systems or OCIO/ State approved services. “Data Encryption” refers to enciphering data with a NIST-approved algorithm or cryptographic module using a NIST-approved key length. Encryption must be applied in such a way that it renders data unusable to anyone but the authorized users. “Personal Information” means information defined in RCW 42.56.590(10). The State classifies data into categories based on the sensitivity of the data pursuant to the Security policy and standards promulgated by the Office of the state of Washington Chief Information Officer. The Data that is the subject of this DSA is classified as indicated below: Category 1 – Public Information Public information is information that can be or currently is released to the public. It does not need protection from unauthorized disclosure, but does need integrity and availability protection controls. Category 2 – Sensitive Information Sensitive information may not be specifically protected from disclosure by law and is for official use only. Sensitive information is generally not released to the public unless specifically requested. Category 3 – Confidential Information Confidential information is information that is specifically protected from disclosure by law. It may include but is not limited to: a. Personal Information about individuals, regardless of how that information is obtained; b. Information concerning employee personnel records; c. Information regarding IT infrastructure and security of computer and telecommunications systems; Category 4 – Confidential Information Requiring Special Handling Confidential information requiring special handling is information that is specifically protected from disclosure by law and for which: a. Especially strict handling requirements are dictated, such as by statutes, regulations, or agreements; b. Serious consequences could arise from unauthorized disclosure, such as threats to health and safety, or legal sanctions. 3. PERIOD OF AGREEMENT This agreement shall begin on July 1, 2024, or date of execution, whichever is later, and end on June 30, 2027, unless terminated sooner or extended as provided herein.