WA State Depatment of Licensing 2/16/2017

ATTACHMENT A DATA SECURITY REQUIREMENTS DATA SECURITY REQUIREMENTS 1. Data Classification The classification of the Data shared is considered: ❑ Category 1 —Public Information ❑ Category 2—Sensitive Information ❑ Category 3—Confidential Information Z Category 4—Confidential Information Requiring Special Handling Data described in this Contract is assessed to be in the following data classification: "Category 4—Confidential Information Requiring Special Handling" as defined by Attachment A, Data Security Requirements. Confidential Information requiring special handling is information that is specifically protected from disclosure by law and for which: a. Especially strict handling requirements are dictated, such as by statutes, regulations, or this Contract. b. Serious consequences could arise from unauthorized disclosure, such as threats to health and safety, or legal sanctions. 2. Computer Security Licensee shall maintain the computers that access DOL Data by ensuring the operating system and software are updated and patched regularly, such that they remain secure from known vulnerabilities. Licensee further agrees that the computer device(s) are installed with an Anti-Virus solution and signatures updated frequently. 3. Access Security Access to the Data will be restricted to authorized Users by requiring a login using a unique User ID and complex password or other authentication mechanism which provides equal or greater security. Passwords must be changed on a periodic basis and the sharing of User ID and passwords is strictly prohibited. 4. Data Storage Licensee agrees that any and all DOL Data will be stored, processed, and maintained solely on designated computing equipment and that no DOL Data at any time will be processed on or transferred to any portable storage medium. 5. Data Transmission Licensee agrees that any and all electronic transmission or exchange of system and application data with DOL and/or any other parties expressly designated by DOL shall take place via secure means (e.g., HTTPS or SFTP). 6. Distribution of Data Licensee shall ensure no DOL Data of any kind shall be transmitted, exchanged, or otherwise passed to other Licensees/vendors or other parties except on a case-by-case basis as specifically agreed to in writing by DOL. Licensee further agrees not to provide screen prints outside their control. Any screen print must be destroyed as referenced in the Data Disposal section of these Data Security Requirements. 7. Data Disposal Unless otherwise specified in this Contract, Licensee agrees that upon termination of this Contract it shall erase, destroy, and render unrecoverable all DOL Data and certify in writing that these actions have been completed within thirty (30) days of the termination of this Contract or within seven (7) days of the request of DOL, whichever shall come first. At a minimum, media sanitization is to be performed according to the standards enumerated by NIST SP 800-88 Guidelines for Media Sanitization. K5881 Page 12 of 14 1/20/2017