Agda Pkt 2025.06.09 Joint SA PFA

Browse Search

Page 12 tablets, backup tapes etc.). Encryption must be a FIPS 140-2 certified algorithm 128 bit or higher, such as AES. It is encouraged, when available and when feasible, that the encryption be 256 bits. s. Contractor shall ensure that all workstations, laptops and other systems, which process and/or store PII, must install and actively use an antivirus software solution. Antivirus software should have automatic updates for definitions scheduled at least daily. In addition, Contractor shall ensure that: i. All workstations, laptops and other systems, which process and/or store PII, must have critical security patches applied, with system reboot if necessary. ii. There must be a documented patch management process that determines installation timeframe based on risk assessment and vendor recommendations. iii. At a maximum, all applicable patches deemed as critical must be installed within thirty (30) days of vendor release. It is recommended that critical patches which are high risk be installed within seven (7) days. iv. Applications and systems that cannot be patched within this time frame, due to significant operational reasons, must have compensatory controls implemented to minimize risk. t. Contractor shall ensure that all of its staff accessing Personally Identifiable Information on applications and systems will be issued a unique individual password that is a least eight (8) characters, a non-dictionary word, composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: upper case letters (A-Z); lower case letters (a-z); Arabic numerals (0-9) and special characters (!, @, #, etc.). Passwords are not to be shared and changed if revealed or compromised. All passwords must be changed every (90) days or less and must not be stored in readable format on the computer or server. u. Contractor shall ensure that usernames for its staff authorized to access PII will be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee within twenty- four (24) hours. Note: Twenty-four (24) hours is defined as one (1) working day. v. Contractor shall ensure when no longer needed, all PII must be cleared, purged, or destroyed consistent with NIST SP 800-88, Guidelines for Media Sanitization, such that the Personally Identifiable Information cannot be retrieved. w. Contractor shall ensure that all of its systems providing access to PII must provide an automatic timeout, requiring re-authentication of the user session after no more than twenty (20) minutes of inactivity. x. Contractor shall ensure that all of its systems providing access to PII must display a warning banner stating, at a minimum that data is confidential; systems are logged, systems use is for business purposes only by authorized users and users shall log off the system immediately if they do not agree with these requirements. y. Contractor will ensure that all of its systems providing access to PII must maintain an automated audit trail that can identify the user or system process which initiates a request for PII or alters PII. The audit trail shall be date and time stamped; log both successful and failed accesses be read-access only; and be restricted to authorized users. If PII is stored in a iv. Applications and systems that cannot be patched within this time iv. Applications and systems that cannot be patched within this time frame, dueframe, due significant operational reasons, must have compensatory significant operational reasons, must have compensatory controls implementedcontrols implemented ATTY/AGR/2025.134/ CORE SERVICE AGENCY CONTRACT (SMC AND RWC) REV: 06-04-25 VR Page 12 of 48 6.L. - Page 15 of 51 112