Agmt19 County of San Mateo - Laserfiche WebLink

Browse Search

dd. Contractor shall ensure that all of its systems processing and/or storing P I I must have a process or automated procedure in place to review system logs for unauthorized access. ee. Contractor shall ensure that all of its systems processing and/or storing PH must have a documented change control process that ensures separation of duties and protects the confidentiality, integrity and availability of data. ff. Contractor shall establish a documented plan to enable continuation of critical business processes and protection of the security of PH kept in an electronic format in the event of an emergency. Emergency means any circumstance or situation that causes normal computer operations to become unavailable for use in performing the work required under this Agreement for more than twenty-four (24) hours. gg. Contractor shall ensure its data centers with servers, data storage devices, and critical network infrastructure involved in the use, storage and/or processing of PII, must include environmental protection such as cooling, power, and fire prevention, detection, and suppression. hh. Contractor shall establish documented procedures to backup PH to maintain retrievable exact copies of PIII. The documented backup procedures shall contain a schedule which includes incremental and full backups, storing backups offsite, inventory of backup media, recovery of PH data, an estimate of the amount of time needed to restore PH data. ii. Contractor shall ensure that PI in paper form shall not be left unattended at any time, unless it is locked space such as a file cabinet, file room, desk or office. Unattended means that information may be observed by an individual not authorized to access the information. Locked spaces are defined as locked file cabinets, locked file rooms, locked desks, or locked offices in facilities which are multi -use, meaning that there are Contractor's staff and non -Contractor functions in one building in work areas that are not securely segregated from each other. It is recommended that all PI be locked up when unattended at any time, not just within multi -use facilities. jj. Contractor shall ensure that any PH that must be disposed of will be through confidential means, such as cross cut shredding or pulverizing. kk. Contractor agrees that PH must not be removed from its facilities except for identified routine business purposes or with express written permission of the County. Il. Contractor shall ensure that faxes containing PH shall not be left unattended and fax machines shall be in secure areas. Faxes containing PH shall contain a confidentiality statement notifying persons receiving Template Version Dote—August 26, 2016 Page 11