Administrative and Personnel Security Sample Clauses

Administrative and Personnel Security. Rutgers University, the Bloustein School, and the Heldrich Center have developed, as well as maintain, monitor and enforce security responsibilities required for data owned by the State of New Jersey. Policies and protocols evident in policies, practices and protocols articulated earlier in this document, include responsibilities for administration and management of the technical infrastructure, implementing, maintaining and enforcing security and the protection of confidential data, as well as policies and protocols for maintaining and enforcing the integrity, storage and access to the data

Administrative and Personnel Security. ▪ Regulations and security requirements – how the Bidder will address security requirements such as PCI, HIPAA, FISMA and etc. ▪ System, Administrative and Personnel Security - the security responsibilities of and supervision required for information owned and / or operated by the Bidder. Security responsibilities include responsibilities for administration of the infrastructure, implementing or maintaining security and the protection of the confidentiality, integrity, and availability of information systems or processes. ▪ Workforce Security - the control process for hiring and terminating of Bidder’s employees, and method used for granting and denying access to the Bidder’s network, systems and applications. Identify and define audit controls when employment of the employee terminates. Identify rules of behavior. ▪ Role-based security access – the products and methods provide role-based security, access enforcement and least privilege. ▪ Account Management – the products and methods identify and control the account types to meet defined regulation and security requirements. ▪ Password Management – the appropriate password management controls to meet defined regulation or security requirements. ▪ Logging / Auditing controls – the Bidder’s audit control methods and requirements. The controls must address but are not limited to all user access and user identification linked to any changes to the system and data, and provide an audit process that will make all audit data accessible to state and federal audit staff. The audit trail of all transactions should track date, time, user, and end-user device that initiated the transaction. The audit data must be protected, non-repudiated and restricted to authorized staff. Retention of the audit records will be retained online for at least ninety days and further preserve offline for a period of the contract or required State and Federal laws and regulations. ▪ Incident Management – the methods for detecting, reporting and responding to an incident, vulnerabilities and threats. The methods are tested and exercised. ▪ Vulnerability / Security Assessment – the products and methods used for scanning for vulnerabilities and remediation of the vulnerabilities. Identify and define methods used for initiating and completing security assessments. All systems and applications shall be subject to vulnerability assessment scans by an independent and accredited third party on an annual basis. Policy documentation has been provi...