Agmt19 County of San Mateo - Laserfiche WebLink

Browse Search

j. Contractor shall ensure that there are security guards or a monitored alarm system at all times at Contractor's facilities and leased facilities where five hundred (500) or more individually identifiable records of PH is used, disclosed, or stored. Video surveillance systems are recommended. k. Contractor shall ensure that data centers with servers, data storage devices, and/or critical network infrastructure involved in the use, storage, and/or processing of PII have perimeter security and physical access controls that limit access to only those authorized by this Agreement. Visitors to any Contractor data centers area storing PI as a result of administration of a County program must be escorted at all times by authorized Contractor's staff. I. Contractor shall have policies that include, based on applicable risk factors, a description of the circumstances under which Contractor staff can transport Pit, as well as the physical security requirements during transport. m. Contractor shall ensure that any PII stored in a vehicle shall be in a non- visible area such as a trunk, that the vehicle is locked, and under no circumstances permit PII be left unattended in a vehicle overnight or for other extended periods of time. n. Contractor shall ensure that PI shall not be left unattended at any time in airplanes, buses, trains, etc., including baggage areas. This should be included in training due to the nature of the risk. o. Contractor shall ensure that all workstations and laptops, which use, store and/or process Pit, must be encrypted using a FIPS 140-2 certified algorithm 128 bit or higher, such as Advanced Encryption Standard (AES). The encryption solution must be full disk. It is encouraged, when available and when feasible, that the encryption be 256 bit. p. Contractor shall ensure that servers containing unencrypted PH must have sufficient administrative, physical, and technical controls in place to protect that data, based upon a risk assessment/system security review. It is recommended to follow the guidelines documented in the latest revision of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations. q. Contractor agrees that only the minimum necessary amount of Pit required to perform required business functions will be accessed, copied, downloaded, or exported. Template Version Date—August 26, 2016 Page 8