Agmt16 IPS - Laserfiche WebLink

Browse Search

xiv. 1 .3 SECURITY xv. A. CMS and all subsystem controllers shall have security protocols and password protection that prevent unauthorized access or manipulation of data and reports including individual transactions. IPS complies. Only authorized users with a login and password will have access to the DMS. B. All databases of transactions, reports, etc. shall be secured by means of password from unauthorized entry and tampering from either within or outside CMS. IPS complies. C. The System must include a minimum of 6 levels of access authorization to all operational, administrative and reporting functions and provide the following security features: 1. Define individual user and group based security 2. Ability to assign a unique user ID for each person authorized to use the system 3. Ability to assign a unique password and periodically change that password for each authorized user ID 4. Ability to establish an expiration period for passwords 5. Ability to disable a user ID following successive long-on failures exceeding a specific limit 6. Ability to view and report user and group level security rights 7. Ability to de-activate codes for former users and internal and external customers 8. Available user-defined fields IPS complies. The City can manage the level of access that each authorized user has to ensure that settings are not manipulated. Each user that securely logs into the DMS is required to provide a usemame and password. Each user will also be assigned to a defined user profile that defines which reports are visible and which ones are not accessible. Samples of these profiles include Administrator, Coin Collection, Customer Service, Manager, Financial Analyst, Utility Manager, and Technician. D. PCI Data Security Standard 1. Compliance programs are offered by the individual financial institutions on the PCI council. The MSM Vendor shall submit proof of PCI DSS compliance and PABP validation. On-going compliance must be provided at no cost to the City. IPS complies. IPS was the first single-space credit card-enabled parking meter vendor to become PCI- certified in 2008. Today we process over 60 million credit card transactions each year, safely and securely. Please see the Appendix for copies of our PCI and PA-DSS certifications. a. Acceptable proof of PCI DSS Compliance and PABP Validation is that the vendor/manufacturer is listed on both Visa and MasterCard web sites as PCI Compliant and having PABP Validation. IPS complies. IPS is listed as a valid service provider for the Visa Cardholder Information Security Program (CISP) and the MasterCard Site Data Protection (SDP) programs and is fully compliant with all PCI-DSS and PA-DSS guidelines. b. It is not acceptable to merely to state that the credit card processor is PCI DSS Compliant or that it is in the process of becoming compliant and/or receiving validation. IPS complies. IPS has been certified since 2008. 2.1 HOSTED CMS SOFTWARE SYSTEMS REV: 05-05-16 JS Page 35 of 177 ATTY/AGR.2016.094/IPS Group