ORCA 6/13/2019 - Laserfiche WebLink

service office; (b) processed at the Agency's call center; and (c) under a Business Account Agreement when acting as the Business Account Lead Agency. 7.1.12 Comply with Generally Accepted Accounting Principles (GAAP), methods prescribed by the Washington State Auditor and business rules established by the Joint Board in accounting for assets, liabilities, resources and expenditures related to the ORCA System. 7.1.13 Allow access to facilities and records and/or conduct annual audits in accordance with GAAP and Generally Accepted Auditing Standards (GAAS); report audit concerns to the ROOT. 7.1.14 Collect, report and pay any taxes applicable to transactions that are processed by the Agency. Each Agency shall indemnify, defend and hold harmless other Agencies from claims, judgments and penalties of any kind and for all cost incurred (including attorney fees) as a result of the Agency's non-compliance with this subsection. 7.1.15 Agree to address all "user control considerations" identified in the Service Organization Controls (SOC) diagnostic review performed by an external auditor and implement such control activities or risk mitigation recommendations made in future external auditor engagements for the ROOT or SI Contractor. 7.1.16 Maintain insurance, or if self-insured, adequate reserves to respond to potential issues that arise through the course of the operation of the ORCA System. Without limiting any Agency's defense and indemnification obligations under this Agreement, each Agency shall maintain in force, at all times during the term of this Agreement, a policy or policies of Commercial General Liability insurance with limits not less than $1 million with insurance carriers authorized to do business in the state of Washington, which have a Best's rating of no less than A: VIII. If an Agency is self-insured, or is a member of a self- insurance pool, a certification of self-insurance covering the activities of the Agency in the ORCA System shall constitute compliance with this insurance requirement. Upon request of the Joint Board, each Agency shall submit documentation demonstrating its compliance with this insurance requirement. 7.2 Security. 7.2.1 Adequately manage the security of the Agency's portions of the system, and collectively, the ORCA System, including (but not limited to)the Payment Card Industry Data Security Standard (PCI-DSS), as evaluated against the version that is enforceable during the compliance period being assessed. 7.2.2 Incorporate and follow best security practices, the applicable standards at the point in time, in the operation and maintenance of the Agency's respective portions of the ORCA System. 7.2.3 Comply with the provisions of business rules and data security policies adopted by the Joint Board. 19