2018/08/08 Council Agenda Packet

JL 4 a) The Open Web Application Security Project Top Ten (OWASP Top 10), or b) The CWEJSANS TOP 25 Most Dangerous Software Errors 6. COMPUTER SECURITY Licensee shall maintain computers that access Data by ensuring the operating system and software are updated and patched monthly, such that they remain secure from known vulnerabilities. Licensee computer device(s) must also be installed with an Anti-Maiware solution and signatures updated no less than monthly. 7. DATA STORAGE Licensee shall designate and be able to identify all computing equipment, on which Licensee stores, processes, and maintains Data. No Data at any time may be processed on or transferred to any portable storage medium. Laptop/tablet computing devices are not considered portable storage medium in this context provided it is installed with end-point encryption. 8. ELECTRONIC DATA TRANSMISSION Licensee shall maintain secure means (e.g., HTTPS or SFTP) for the electronic transmission or exchange of system and application data with DOL or any other authorized Licensee. 9. DATA ENCRYPTION Licensee shall encrypt all Data, whether in transit or at rest, by using only NIST or ISO approved encryption algorithms; this includes all back-up copies of Data. Licensee further must install any laptop/notebook computing device, processing Data, with end-point encryption (i.e., full disk encryption). 10. DISTRIBUTION OF DATA Licensee may only use and exchange Confidential Information for the purposes as expressly described and allowed in this Agreement. In addition to any other restrictions on Permissible Use, Confidential Information may not be distributed, repurposed or shared across other applications, environments, or business units of Licensee. Licensee must assure that no Confidential Information of any kind is transmitted, exchanged or otherwise passed to other contractors/vendors or interested parties except Licensee and/or Subrecipients who have an authorized legal Permissible Use according to this Agreement, and who are under contract with Licensee. 11. DATA DISPOSAL Unless a more immediate disposal requirement is set forth in this Agreement, Licensee, upon termination of this Agreement, shall erase, destroy, and render unrecoverable all DOL Confidential Data and certify in writing that these actions have been completed within thirty (30) days of the termination of this Agreement. At a minimum, media sanitization is to be performed according to the standards enumerated by NIST SP 800-88r1 Guidelines for Media Sanitization. 12. OFFSHORING - ELECTRONIC Licensee must maintain the primary, backup, disaster recovery and other sites for storage of Confidential Data only from locations in the United States. Licensee may not commit the following unless it has advance written approval from DOL: a) Directly or indirectly (including through Subrecipients) transmit any Confidential Data outside the United States; or b) Allow any Confidential Data to be accessed by Subrecipients from locations outside of Page 10 of 12 19