2018/08/08 Council Agenda Packet

I4 Attachment A Data Security Requirements 'I. DATA CLASSIFICATION The classification of the Data shared under this Agreement includes: ❑ Category 1 — Public Information ❑ Category 2—Sensitive Information ® Category 3—Confidential Information (includes Personal Information) Z Category 4— Confidential Information Requiring Special Handling (if Social Security Numbers, or medical information are provided) For all Confidential Data that is electronically stored, processed, or transmitted, Licensee shall apply the following requirements: 2. DATA SECURITY Licensee must protect the confidentiality, integrity and availability of Data with administrative, technical and physical measures that meet generally recognized industry standards and best practices or standards established by the Washington State Office of the Chief Information Officer (OCiO). Examples of industry standards and best practices include any of the following: a) ISO 27002 b) PCI DSS c) NIST 800 series d) OCIO 141.10 (https://ocio.wa.gov/policies/'141-securinci-information-technology- assets/14110-securing-information-technology-assets) NOTE: DOL has the right to implement security measures that.may exceed OCIO or industry standards and best practices; if any security measures of this Agreement exceed OCIO or industry standards and best practices, then the higher DOL measures will apply. However, if any security measures of this Agreement fall below OCIO standards,then OCIO standards will apply. 3. NETWORK SECURITY Licensee's network security must include the following: a) Network firewall provisioning b) Intrusion detection c) Quarterly vulnerability assessments d) Annual penetration tests. 4. ACCESS SECURITY Licensee shall restrict Authorized User access to the Data by requiring a login using a unique user ID and complex password or other authentication mechanism which provides equal or greater security. Passwords must be changed on a periodic basis at least quarterly. The sharing of user ID and passwords is strictly prohibited. Licensee is solely responsible for protection of all of its user IDs and passwords, and is responsible for all breaches caused through the use of its user IDs and passwords. 5. APPLICATION SECURITY Licensee shall maintain and support its software and subsequent upgrades, updates, patches, and bug fixes such that the software is, and remains secure from known vulnerabilities. Licensee must secure web applications that minimally meet all the security controls as generally described in either: 18