Agmt25 Granicus, LLC - Laserfiche WebLink

Browse Search

REV: 12-16-24 MI 2.3All access will be assigned using a unique identifier (User ID) and will be required to meet the password complexity requirements in accordance with NIST 800-53. 2.4Granicus will ensure that a password has a minimum of eight characters and contains at least two of the following parameters: (i) alphanumeric characters; (ii) uppercase and lowercase characters, and; (iii) special characters. 2.5Multiple authorization levels will be used when granting access to sensitive information resources, including those storing and processing personal information in accordance with the Granicus Information Security policies. 2.6All privileged access to production will be controlled by adequate security controls. 2.7User access will be documented and reviewed on a periodic basis, based on risk. Granicus will ensure that unauthorized persons are prevented from gaining physical access to premises, buildings, or rooms where data processing systems that process or use Personal Data are located: 2.8 Granicus protects its information resources and physical facilities using the adequate physical and logical controls in accordance with the Granicus Information Security Policies. 2.9In general, buildings are secured through access control systems (e.g., smart card access system). 2.10 As a minimum requirement, the outermost entrance points of the building must be fitted with a certified key system including modern, active key management 2.11 Depending on the security classification, buildings, individual areas and surrounding premises may be further protected by additional measures. These include specific access profiles, video surveillance, intruder alarm systems and biometric access control systems. 2.12 Access rights are granted to authorized persons on an individual basis according to the System and Data Access Control measures (see below). This also applies to visitor access. Guests and visitors to Granicus buildings must register their names at reception and must be accompanied by authorized Granicus personnel. 2.13 Granicus employees and external personnel must wear their ID cards at all Granicus locations. 2.14 All data centers adhere to strict security procedures enforced by guards, surveillance cameras, motion detectors, access control mechanisms and other measures to prevent equipment and data center facilities from being compromised. Only authorized representatives have access to systems and infrastructure within the data center facilities. To protect proper functionality, physical security equipment (e.g., motion sensors, cameras, etc.) undergo maintenance on a regular basis. 2.15 Granicus and all third-party data center providers log the names and times of authorized personnel entering Granicus’s private areas within the data centers. 3 DATA TRANSMISSION CONTROL Except as necessary for the provision of the Cloud Services in accordance with the Services Agreement, Granicus will ensure that Personal Data will not be read, copied, modified, or removed without authorization during transfer. Where data carriers are physically transported, adequate measures will be implemented at Granicus to provide the agreed-upon service levels (for example, encryption and lead-lined containers): 3.1 Personal Data in transfer over Granicus internal networks will be protected according to the Granicus Information Security Policies. 3.2 When data is transferred between Granicus and its Customers, the protection measures for the transferred Personal Data will be mutually agreed upon and made part of the relevant agreement. This applies to both physical and network-based data transfer. In any case, the Customer assumes responsibility for any data transfer once it is outside of Granicus-controlled systems (e.g., data being transmitted outside the firewall of the Granicus data center). 4 JOB CONTROL Granicus will ensure that Personal Data being processed on commission (i.e., Personal Data processed on a customer’s behalf) is processed solely in accordance with the Master Subscription ATTY/AGR.2024.237/Granicus (Agenda Management System) (Page 33 of 35)