Agda Pkt 2025.06.09 Joint SA PFA

Browse Search

Page 13 database, database logging functionality shall be enabled. The audit trail data shall be archived for at least three (3) years from the occurrence. z. Contractor shall ensure that all of its systems providing access to PII shall use role-based access controls for all user authentications, enforcing the principle of least privilege. aa. Contractor shall ensure that all data transmissions of PII outside of its secure internal networks must be encrypted using a Federal Information Processing Standard (FIPS) 140-2 certified algorithm that is 128 bit or higher, such as Advanced Encryption Standard (AES) or Transport Layer Security (TLS). It is encouraged, when available and when feasible, that 256-bit encryption be used. Encryption can be ended to end at the network level, or the data files containing PII can be encrypted. This requirement pertains to any type of PII in motion such as website access, file transfer, and email. bb. Contractor shall ensure that all of its systems involved in accessing, storing, transporting, and protecting PII, which are accessible through the Internet, must be protected by an intrusion detection and prevention solution. cc. Contractor shall ensure that audit control mechanisms are in place. All Contractor systems processing and/or storing Personally Identifiable Information must have a least an annual system risk assessment/security review that ensure administrative, physical, and technical controls are functioning effectively and provide an adequate level of protection. Review shall include vulnerability scanning tools. dd. Contractor shall ensure that all of its systems processing and/or storing PII must have a process or automated procedure in place to review system logs for unauthorized access. ee. Contractor shall ensure that all of its systems processing and/or storing PII must have a documented change control process that ensures separation of duties and protects the confidentiality, integrity and availability of data. ff. Contractor shall establish a documented plan to enable continuation of critical business processes and protection of the security of PII kept in an electronic format in the event of an emergency. Emergency means any circumstance or situation that causes normal computer operations to become unavailable for use in performing the work required under this Agreement for more than twenty-four (24) hours. gg. Contractor shall ensure its data centers with servers, data storage devices, and critical network infrastructure involved in the use, storage and/or processing of PII, must include environmental protection such as cooling, power, and fire prevention, detection, and suppression. hh. Contractor shall establish documented procedures to backup PII to maintain retrievable exact copies of PIII. The documented backup procedures shall contain a schedule which includes incremental and full backups, storing backups offsite, inventory of backup media, recovery of PII data, an estimate of the amount of time needed to restore PII data. ii. Contractor shall ensure that PII in paper form shall not be left unattended at any time, unless it is locked space such as a file cabinet, file room, desk or office. Unattended means that information may be observed by an individual not authorized to access the information. Locked spaces are defined as locked file cabinets, locked file rooms, locked desks, or locked offices in t control mechanisms are in place. t control mechanisms are in place. processing and/or storing Personally Identifiable Information must have a least an annual processing and/or storing Personally Identifiable Information must have a least an annual system risk assessment/security review that system risk assessment/security review that ensure administrativeensure administrative, physical, and technical , physical, and technical ATTY/AGR/2025.134/ CORE SERVICE AGENCY CONTRACT (SMC AND RWC) REV: 06-04-25 VR Page 13 of 48 6.L. - Page 16 of 51 113