Agmt22 Granicus - Laserfiche WebLink

Browse Search

REV: 06-24-22 RL 2. PHYSICAL AND LOGICAL ACCESS Granicus maintains an effective process to control and secure access to the data processing system(s) and sensitive information resources leveraging secure authentication, and authorization mechanisms: 2.1 Document procedures for granting and revoking access to Granicus information resources. 2.2 Access restrictions will be based on role and need-to-know and least privilege principles. 2.3 All access will be assigned using a unique identifier (User ID) and will be required to meet the password complexity requirements in accordance with NIST 800-53. 2.4 Granicus will ensure that a password has a minimum of eight characters and contains at least two of the following parameters: (i) alphanumeric characters; (ii) uppercase and lowercase characters, and; (iii) special characters. 2.5 Multiple authorization levels will be used when granting access to sensitive information resources, including those storing and processing personal information in accordance with the Granicus Information Security policies. 2.6 All privileged access to production will be controlled by adequate security controls. 2.7 User access will be documented and reviewed on a periodic basis, based on risk. Granicus will ensure that unauthorized persons are prevented from gaining physical access to premises, buildings, or rooms where data processing systems that process or use Personal Data are located: 2.8 Granicus protects its information resources and physical facilities using the adequate physical and logical controls in accordance with the Granicus Information Security Policies. 2.9 In general, buildings are secured through access control systems (e.g., smart card access system). 2.10 As a minimum requirement, the outermost entrance points of the building must be fitted with a certified key system including modern, active key management 2.11 Depending on the security classification, buildings, individual areas and surrounding premises may be further protected by additional measures. These include specific access profiles, video surveillance, intruder alarm systems and biometric access control systems. 2.12 Access rights are granted to authorized persons on an individual basis according to the System and Data Access Control measures (see below). This also applies to visitor access. Guests and visitors to Granicus buildings must register their names at reception and must be accompanied by authorized Granicus personnel. 2.13 Granicus employees and external personnel must wear their ID cards at all Granicus locations. 2.14 All data centers adhere to strict security procedures enforced by guards, surveillance cameras, motion detectors, access control mechanisms and other measures to prevent equipment and data center facilities from being compromised. Only authorized representatives have access to systems and infrastructure within the data center facilities. To protect proper functionality, physical security equipment (e.g., motion sensors, cameras, etc.) undergo maintenance on a regular basis. 2.15 Granicus and all third-party data center providers log the names and times of authorized personnel entering Granicus’s private areas within the data centers. 3 DATA TRANSMISSION CONTROL Except as necessary for the provision of the Cloud Services in accordance with the Services Agreement, Granicus will ensure that Personal Data will not be read, copied, modified, or removed without authorization during transfer. Where data carriers are physically transported, adequate ATTY/AGR.2022.156/Granicus (Online agenda and meeting hosting and indexing) (Page 30 of 32)