Outside Entity Obligations. It is the outside entities’ and their workforce members’ responsibility to maintain knowledge of and compliance with relevant and applicable Department procedures. Notice of planned events in an outside entity’s computing environment that may impact its secured connection, in any way or at any severity level, to the Department must be submitted to the Department at least one week in advance of the event. The Department must receive notice in electronic and written form from an outside entity when any unexpected event of interest occurs in any way or at any level of severity within or around the outside entity’s computing environment that may impact the Department’s information security. Events including but not limited to malware (virus, trojan, etc) discovery, network or system breaches, privileged account compromise, employee or workforce member misconduct, etc, are examples of events of interest to the Department. Outside entity workstations are not to access any resource or download any software from the Department’s information network without prior approval. Before connection and while connected to a VPN formed with the Department the outside entity’s computing environment (computing devices including workstations, servers, and networking devices) must be operating the latest available software versions and applicable patches, and have the following implemented with supporting policies or procedures available for review by the Department: • Active and effective network device, server and workstation operating system and layered software patch or update processes. • Department approved, up-to-date server and workstation anti-virus/malware software (all components) installed with active and effective patch or update processes in place. Outside entity workforce members with VPN access privileges to the Department’s network shall not use non-Department email accounts (i.e., Hotmail, Yahoo, AOL), or other external information resources to conduct Department business, ensuring a reduced risk to Department data and that Department business is never confused with personal business. With regard to VPN connections used by outside entities that are provided by Department-approved VPN providers, the Department bears no responsibility if the installation of VPN software, or the use of any remote access systems, causes system lockups, crashes or complete or partial data loss on any outside entity computing or network equipment. The outside entity is solely respons...
Outside Entity Obligations
