Laserfiche WebLink
Docusign Envelope ID; 72A9lE33M-BEA1-46FE-ACDD-146571B87804 <br />EXHIBIT 2 <br />B. Log both successful and failed accesses; <br />C. Be read -access only; and <br />D. Be restricted to authorized users. <br />iii. If PI I is stored in a database, database logging functionality shall be enabled. <br />iv. Audit trail data shall be archived for at least three (3) years from the occurrence. <br />I. Access Controls. The system providing access to PIE shall use role -based access controls <br />for all user authentications, enforcing the principle of least privilege. <br />m. Transmission Encryption. <br />i. All data transmissions of PH outside of a secure internal network must be <br />encrypted using a Federal Information Processing Standard (PIPS) 140-2 certified <br />algorithm that is 128 bit or higher, such as Advanced Encryption Standard (AES) <br />or Transport Layer Security (TLS). It is encouraged, when available and when <br />feasible, that 256 bit encryption be used. <br />ii. Encryption can be end to end at the network level, or the data files containing PII <br />can be encrypted. <br />iii. This requirement pertains to any type of PH in motion such as website access, file <br />transfer, and email. <br />n. Intrusion Prevention. All systems involved in accessing, storing, transporting, and <br />protecting PII, which are accessible through the Internet, must be protected by an <br />intrusion detection and prevention solution. <br />8. AUDIT CONTROLS <br />a. System Security Review. <br />i. The Contractor must ensure audit control mechanisms are in place. <br />ii. All systems processing and/or storing PH must have at least an annual system risk <br />assessment/security review that ensures administrative, physical, and technical <br />controls are functioning effectively and provide an adequate level of protection. <br />iii. Reviews should include vulnerability scanning tools. <br />b. Log Reviews. All systems processing and/or storing PH must have a processor automated <br />procedure in place to review system logs for unauthorized access. <br />c. Change Control. All systems processing and/or storing PII must have a documented <br />City Council 7 — 124 7/15/2025 <br />