Laserfiche WebLink
6.13. - Page 14 of 42 <br />dd. Contractor shall ensure that all of its systems processing and/or storing PI <br />must have a process or automated procedure in place to review system <br />logs for unauthorized access. <br />ee. Contractor shall ensure that all of its systems processing and/or storing PI <br />must have a documented change control process that ensures separation <br />of duties and protects the confidentiality, integrity and availability of data. <br />ff. Contractor shall establish a documented plan to enable continuation of <br />critical business processes and protection of the security of PH kept in an <br />electronic format in the event of an emergency. Emergency means any <br />circumstance or situation that causes normal computer operations to <br />become unavailable for use in performing the work required under this <br />Agreement for more than twenty-four (24) hours. <br />gg. Contractor shall ensure its data centers with servers, data storage <br />devices, and critical network infrastructure involved in the use, storage <br />and/or processing of PII, must include environmental protection such as <br />cooling, power, and fire prevention, detection, and suppression. <br />hh. Contractor shall establish documented procedures to backup PI to <br />maintain retrievable exact copies of PIII. The documented backup <br />procedures shall contain a schedule which includes incremental and full <br />backups, storing backups offsite, inventory of backup media, recovery of <br />PI data, an estimate of the amount of time needed to restore PI data. <br />Contractor shall ensure that PH in paper form shall not be left unattended <br />at any time, unless it is locked space such as a file cabinet, file room, desk <br />or office. Unattended means that information may be observed by an <br />individual not authorized to access the information. Locked spaces are <br />defined as locked file cabinets, locked file rooms, locked desks, or locked <br />offices in facilities which are multi -use, meaning that there are Contractor's <br />staff and non -Contractor functions in one building in work areas that are <br />not securely segregated from each other. It is recommended that all PH <br />be locked up when unattended at any time, not just within multi -use <br />facilities. <br />jj. Contractor shall ensure that any PH that must be disposed of will be <br />through confidential means, such as cross cut shredding or pulverizing. <br />kk. Contractor agrees that PH must not be removed from its facilities except <br />for identified routine business purposes or with express written permission <br />of the County. <br />II. Contractor shall ensure that faxes containing PH shall not be left <br />unattended and fax machines shall be in secure areas. Faxes containing <br />PI shall contain a confidentiality statement notifying persons receiving <br />Template Version Date —August 26, 2016 <br />Page 11 <br />T <br />