Agenda Packet_2025-07-15 - Laserfiche WebLink

Home Browse Search

Docusign Envelope 110: 72A91B3B-BEA1-46FE-ACDD-146571BB7814 EXHIBIT 2 7. TECHNICAL SECURITY CONTROLS a. Workstation/Laptop Encryption. All workstations and laptops, which use, store and/or process PII, must be encrypted using a FIPS 140-2 certified algorithm 128 bit or higher, such as Advanced Encryption Standard (AES). The encryption solution must be full disk. It is encouraged, when available and when feasible, that the encryption be 256 bit. b. Server Security. Servers containing unencrypted PH must have sufficient administrative, physical, and technical controls in place to protect that data, based upon a risk assessment/system security review. It is recommended to follow the guidelines documented in the latest revision of the National Institute of Standards and Technology (MIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations. c. Minimum Necessary. Only the minimum necessary amount of PI1 required to perform required business functions may be accessed, copied, downloaded, or exported. d. Mobile Device and Removable Media. All electronic files, which contain PII data, must be encrypted when stored on any mobile device or removable media (i.e. USB drives, CD/DVD, smartphones, tablets, backup tapes etc.). Encryption must be a FIPS 140-2 certified algorithm 128 bit or higher, such as AES. It is encouraged, when available and when feasible, that the encryption be 256 bit. e. Antivirus Software. All workstations, laptops and other systems, which process and/or store Pli, must install and actively use an antivirus software solution. Antivirus software should have automatic updates for definitions scheduled at least daily. f. Patch Management. i. All workstations, laptops and other systems, which process and/or store Pll, must have critical security patches applied, with system reboot if necessary. ii. There must be a documented patch management process that determines installation timeframe based on risk assessment and vendor recommendations. iii. At a maximum, all applicable patches deemed as critical must be installed within thirty (30) days of vendor release. It is recommended that critical patches which are high risk be installed within seven (7) days. iv. Applications and systems that cannot be patched within this time frame, due to significant operational reasons, must have compensatory controls implemented to minimize risk. 6 City Council 7 — 122 7/15/2025