AgdaPkt 2020-10-12 Joint SA PFA - Laserfiche WebLink

Browse Search

6.Q. - Page 16 of 45 Media Sanitization, such that the Personally Identifiable Information cannot be retrieved. w. Contractor shall ensure that all of its systems providing access to PH must provide an automatic timeout, requiring re -authentication of the user session after no more than twenty (20) minutes of inactivity. x. Contractor shall ensure that all of its systems providing access to PH must display a warning banner stating, at a minimum that data is confidential; systems are logged, systems use is for business purposes only by authorized users and users shall log off the system immediately if they do not agree with these requirements. y. Contractor will ensure that all of its systems providing access to PH must maintain an automated audit trail that can identify the user or system process which initiates a request for PII, or alters PII. The audit trail shall be date and time stamped; log both successful and failed accesses be read -access only; and be restricted to authorized users. If PH is stored in a database, database logging functionality shall be enabled. The audit trail data shall be archived for at least three (3) years from the occurrence. z. Contractor shall ensure that all of its systems providing access to PH shall use role -based access controls for all user authentications, enforcing the principle of least privilege. aa. Contractor shall ensure that all data transmissions of PH outside of its secure internal networks must be encrypted using a Federal Information Processing Standard (FIPS) 140-2 certified algorithm that is 128 bit or higher, such as Advanced Encryption Standard (AES) or Transport Layer Security (TLS). It is encouraged, when available and when feasible, that 256 bit encryption be used. Encryption can be end to end at the network level, or the data files containing PH can be encrypted. This requirement pertains to any type of PH in motion such as website access, file transfer, and email. bb. Contractor shall ensure that all of its systems involved in accessing, storing, transporting, and protecting PII, which are accessible through the Internet, must be protected by an intrusion detection and prevention solution. cc. Contractor shall ensure that audit control mechanisms are in place. All Contractor systems processing and/or storing Personally Identifiable Information must have a least an annual system risk assess ment/security review that ensure administrative, physical, and technical controls are functioning effectively and provide an adequate level of protection. Review shall include vulnerability scanning tools. Template Version Date — August 26, 2016 Page 10 191