Access Controls The system providing access to PHI COUNTY discloses to 20 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY 21 must use role based access controls for all user authentications, enforcing the principle of least privilege.
TIA Controls If any provision of this Indenture limits, qualifies, or conflicts with another provision which is required to be included in this Indenture by the TIA, the required provision shall control.
Plan Controls The terms contained in the Plan are incorporated into and made a part of this Agreement and this Agreement shall be governed by and construed in accordance with the Plan. In the event of any actual or alleged conflict between the provisions of the Plan and the provisions of this Agreement, the provisions of the Plan shall be controlling and determinative.
Personal Controls a. Employee Training. All workforce members who assist in the performance of functions or activities on behalf of COUNTY in connection with Agreement, or access or disclose PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, must complete information privacy and security training, at least annually, at CONTRACTOR’s expense. Each workforce member who receives information privacy and security training must sign a certification, indicating the member’s name and the date on which the training was completed. These certifications must be retained for a period of six (6) years following the termination of Agreement.
Technical Security Controls 35 a. Workstation/Laptop encryption. All workstations and laptops that store PHI COUNTY 36 discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of 37 COUNTY either directly or temporarily must be encrypted using a FIPS 140-2 certified algorithm which 1 is 128bit or higher, such as AES. The encryption solution must be full disk unless approved by the 2 COUNTY.
User IDs and Password Controls All users must be issued a unique user name for accessing DHCS PHI or PI. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee with knowledge of the password, at maximum within 24 hours. Passwords are not to be shared. Passwords must be at least eight characters and must be a non-dictionary word. Passwords must not be stored in readable format on the computer. Passwords must be changed every 90 days, preferably every 60 days. Passwords must be changed if revealed or compromised. Passwords must be composed of characters from at least three of the following four groups from the standard keyboard: • Upper case letters (A-Z) • Lower case letters (a-z) • Arabic numerals (0-9) • Non-alphanumeric characters (punctuation symbols)
Audit Controls a. System Security Review. CONTRACTOR must ensure audit control mechanisms that record and examine system activity are in place. All systems processing and/or storing PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY must have at least an annual system risk assessment/security review which provides assurance that administrative, physical, and technical controls are functioning effectively and providing adequate levels of protection. Reviews should include vulnerability scanning tools.
Access Toll Connecting Trunk Group Architecture 9.2.1 If ECI chooses to subtend a Verizon access Tandem, ECI’s NPA/NXX must be assigned by ECI to subtend the same Verizon access Tandem that a Verizon NPA/NXX serving the same Rate Center Area subtends as identified in the LERG.
9.2.2 ECI shall establish Access Toll Connecting Trunks pursuant to applicable access Tariffs by which it will provide Switched Exchange Access Services to Interexchange Carriers to enable such Interexchange Carriers to originate and terminate traffic to and from ECI’s Customers.
9.2.3 The Access Toll Connecting Trunks shall be two-way trunks. Such trunks shall connect the End Office ECI utilizes to provide Telephone Exchange Service and Switched Exchange Access to its Customers in a given LATA to the access Tandem(s) Verizon utilizes to provide Exchange Access in such LATA.
9.2.4 Access Toll Connecting Trunks shall be used solely for the transmission and routing of Exchange Access to allow ECI’s Customers to connect to or be connected to the interexchange trunks of any Interexchange Carrier which is connected to a Verizon access Tandem.
Quality control system (i) The Contractor shall establish a quality control mechanism to ensure compliance with the provisions of this Agreement (the “Quality Assurance Plan” or “QAP”).
(ii) The Contractor shall, within 30 (thirty) days of the Appointed Date, submit to the Authority’s Engineer its Quality Assurance Plan which shall include the following:
(a) organisation, duties and responsibilities, procedures, inspections and documentation;
(b) quality control mechanism including sampling and testing of Materials, test frequencies, standards, acceptance criteria, testing facilities, reporting, recording and interpretation of test results, approvals, check list for site activities, and proforma for testing and calibration in accordance with the Specifications for Road and Bridge Works issued by MORTH, relevant IRC specifications and Good Industry Practice; and
(c) internal quality audit system. The Authority’s Engineer shall convey its approval to the Contractor within a period of 21 (twenty-one) days of receipt of the QAP stating the modifications, if any, required, and the Contractor shall incorporate those in the QAP to the extent required for conforming with the provisions of this Clause 11.2.
(iii) The Contractor shall procure all documents, apparatus and instruments, fuel, consumables, water, electricity, labour, Materials, samples, and qualified personnel as are necessary for examining and testing the Project Assets and workmanship in accordance with the Quality Assurance Plan.
(iv) The cost of testing of Construction, Materials and workmanship under this Article 11 shall be borne by the Contractor.
Security Controls Annually, upon Fund’s reasonable request, DST shall provide Fund’s Chief Information Security Officer or his or her designee with a summary of its corporate information security policy and an opportunity to discuss DST’s information security measures, and a high level and non-confidential summary of any penetration testing related to the provision of in-scope services . DST shall review its Security Policy annually.
