Agda Pkt 2025.06.09 Joint SA PFA

Browse Search

Page 11 h. Contractor shall ensure that PII is used and stored in an area that is physically safe from access by unauthorized persons at all times and safeguard PII from loss, theft, or inadvertent disclosure by securing all areas of its facilities staff assist in the disclose, or store PII. i. Contractor shall ensure that each physical location, where PII is used, disclosed, or stored, has procedures and controls that ensure an individual who is terminated from access to the facility is promptly escorted from the facility by an authorized employee of Contractor and access is revoked. j. Contractor shall ensure that there are security guards or a monitored alarm system at all times five hundred (500) or more individually identifiable records of PII is used, disclosed, or stored. Video surveillance systems are recommended. k. Contractor shall ensure that data centers with servers, data storage devices, and/or critical network infrastructure involved in the use, storage, and/or processing of PII have perimeter security and physical access controls that limit access to only those authorized by this Agreement. Visitors to any Contractor data centers area storing PII as a result of administration of a county program must l. Contractor shall have policies that include, based on applicable risk factors, a description of the circumstances under which Contractor staff can transport PII, as well as the physical security requirements during transport. m. Contractor shall ensure that any PII stored in a vehicle shall be in a non-visible area such as a trunk, that the vehicle is locked, and under no circumstances permit PII be left unattended in a vehicle overnight or for other extended periods of time. n. Contractor shall ensure that PII shall not be left unattended at any time in airplanes, buses, trains, etc., including baggage areas. This should be included in training due to the nature of the risk. o. Contractor shall ensure that all workstations and laptops, which use, store and/or process PII, must be encrypted using a FIPS 140-2 certified algorithm 128 bit or higher, such as Advanced Encryption Standard (AES). The encryption solution must be full disk. It is encouraged, when available and when feasible, that the encryption be 256 bits. p. Contractor shall ensure that servers containing unencrypted PII must have sufficient administrative, physical, and technical controls in place to protect that data, based upon a risk assessment/system security review. It is recommended to follow the guidelines documented in the latest revision of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations. q. Contractor agrees that only the minimum necessary amount of PII required to perform required business functions will be accessed, copied, downloaded, or exported. r. Contractor shall ensure that all electronic files, which contain PII data is encrypted when stored on any mobile device or removable media (i.e. USB drives, CD/DVD, smartphones, network infrastructure involved in the use, storage, and/network infrastructure involved in the use, storage, and/or processing of PII have perimeter security and physical access controls that security and physical access controls that limit accesslimit access to only thosto only those authorized by this e authorized by this Agreement. Visitors to any Contractor data centers area storing PII as a result of administration Agreement. Visitors to any Contractor data centers area storing PII as a result of administration ATTY/AGR/2025.134/ CORE SERVICE AGENCY CONTRACT (SMC AND RWC) REV: 06-04-25 VR Page 11 of 48 6.L. - Page 14 of 51 111