Laserfiche WebLink
ATTACHMENT 5 <br /> ORCA Business Account Security Standards <br /> 1.0 Application Security <br /> 1.1 At the time the Business Account enters into the ORCA program,the Lead Agency will provide a <br /> single Business Account user id and temporary password to the Business Account's Primary Contact <br /> (as specified in Attachment 2)to enable access to the Business Account's area of the Business <br /> Account Website. <br /> 1.2 The Business Account shall immediately change the temporary password to a strong password that <br /> meets the following criteria: <br /> a. Length: At least eight(8)characters in length or the maximum length permitted by the System, <br /> whichever is shorter. <br /> b. Elements: Contain at least three (3)of the following four(4)elements. <br /> 1) English upper case letters (A, B, C...) <br /> 2) English lower case letters (a, b, c...) <br /> 3) Westernized Arabic numbers(0, 1, 2...9) <br /> 4) Special characters (@, #, %...) <br /> 1.3 The Business Account shall restrict access to the ORCA Business Account Website by providing its <br /> user id and password to the employee(s)who have a business"need to know"and who are <br /> authorized by the Business Account("system user(s)"). <br /> 1.4 Access to the ORCA Business Account Website is restricted to the purpose of authorized <br /> administrative support for the ORCA Business Account program. <br /> 1.5 The Business Account's password shall be changed at least quarterly but also immediately upon (a)a <br /> system user leaving the Business Account's employment or otherwise losing his/her status as an <br /> authorized user; and (b)the Business Account learning that the password has been obtained by <br /> unauthorized persons or entities. <br /> 1.6 Review security policies and guidelines with system users at least quarterly. <br /> 2.0 Physical Security <br /> 2.1 The Business Account shall require system users, when not at their workstations, to log off the <br /> Business Account Website, or lock their screen using a password protected screen-saver in order to <br /> prevent unauthorized access. <br /> 2.2 ORCA card stock shall be kept in a secure/locked location with access limited to those administering <br /> the program. <br /> 2.3 The Business Account shall require its employees to keep printed reports containing account <br /> information in a secure location. <br /> 3.0 Incident Management <br /> 3.1 The Business Account shall report any security incident or suspected incident immediately to the <br /> Lead Agency. Examples of possible security incidents would be introduction of computer viruses, <br /> unauthorized transactions or blocked cards, or lost or stolen card stock. <br /> ORCA Passport Agreement Page 23 of 23 <br /> City of Everett BA ID: 1891 <br /> January 1,2017-December 31,2017 <br />