Agenda Packet_2025-07-15 - Laserfiche WebLink

Home Browse Search

Docusign Enveiope ID: 72A911f3D-i5EA1-46FE-ACDD-146571BB7804 EXHIBIT 2 c. Issue identification badges to Contractor Staff. d. Require Contractor Staff to wear these badges where PII is used, disclosed, or stored. e. Ensure each physical location, where PII is used, disclosed, or stored, has procedures and controls that ensure an individual who is terminated from access to the facility is promptly escorted from the facility by an authorized employee and access is revoked. f. Ensure there are security guards or a monitored alarm system at all times at the Contractor facilities and leased facilities where five hundred (500) or more individually identifiable records of PII is used, disclosed or stored. Video surveillance are recommended. g. Ensure data centers with servers, data storage devices, and/or critical network infrastructure involved in the use, storage, and/or processing of PII have perimeter security and physical access controls that limit access to only authorized Contractor Staff. Visitors to the data center area must be escorted at all times by authorized Contractor Staff. h. Store paper records with PII in locked spaces, such as locked file cabinets, locked file rooms, locked desks, or locked offices in facilities which have multi -use functions in one building in work areas that are not securely segregated from each other. It is recommended that all PII be locked up when unattended at any time, not just within multi -use facilities. The Contractor shall have policies that include, based on applicable risk factors, a description of the circumstances under which the Contractor Staff can transport PII, as well as the physical security requirements during transport. A Contractor that chooses to permit its staff to leave records unattended in vehicles must include provisions in its policies to ensure the PII is stored in a non -visible area such as a trunk, that the vehicle is locked, and under no circumstances permit PII be left unattended in a vehicle overnight or for other extended periods of time. j. The Contractor shall have policies that indicate Contractor Staff are not to leave records with PH unattended at anytime in airplanes, buses, trains, etc., including baggage areas. This should be included in training due to the nature of the risk. k. Use all reasonable measures to prevent non -authorized personnel and visitors from having access to, control of, or viewing PII. 5 City Council 7 — 121 7/15/2025