Agenda Packet_2025-07-15 - Laserfiche WebLink

Home Browse Search

Docusign Envelope IM: 72A91636-BEA1 46FE-AWD-146571 B87804 EXHIBIT 2 g. User iDs and Password Controls. i. All users must be issued a unique username for accessing Pil. ii. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee within twenty-four (24) hours. Note: Twenty-four (24) hours is defined as one (1) working day. iii. Passwords are not to be shared. iv. Passwords must be at least eight (8) characters. V. Passwords must be a non -dictionary word. vi. Passwords must not be stored in readable format on the computer or server. vii. Passwords must be changed every ninety (90) days or less. viii. Passwords must be changed if revealed or compromised. ix. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. Upper case letters (A-Z) B. Lower case letters (a-z) C. Arabic numerals (0-9) D. Special characters (!,@,#, etc.) h. Data Destruction. When no longer needed, all PII must be cleared, purged, or destroyed consistent with MIST SP 800-88, Guidelines for Media Sanitization, such that the PH cannot be retrieved. i. System Timeout. The systems providing access to PII must provide an automatic timeout, requiring re -authentication of the user session after no more than twenty (20) minutes of inactivity. j. Warning Banners. The systems providing access to PH must display a warning banner stating, at a minimum: L Data is confidential; ii. Systems are logged; iii. System use is for business purposes only, by authorized users; and iv. Users shall log off the system immediately if they do not agree with these requirements. k. System Logging. i. The systems which provide access to PII must maintain an automated audit trail that can identify the user or system process which initiates a request for PH or alters PII. ii. The audit trail shall: A. Be date and time stamped; 7 City Council 7 — 123 7/15/2025