Laserfiche WebLink
City of Tukwila My WebLink |HelpSearch Tips |About |Sign Out
DocuSign Envelope ID: 2AD3F796-7214-47FA-941B-50EF046CB431 <br />Attachment 5 <br />ORCA BUSINESS ACCOUNT SECURITY STANDARDS <br />1.0 Application Security <br />1.1 At the time the Business Account enters into the ORCA program, the Lead Agency will provide a single <br />Business Account user id and temporary password to the Business Account's Primary Contact (as specified in <br />Attachment 2, Designated Representatives, to enable access to the Business Account's area of the Business Account <br />Website. <br />1.2 The Business Account shall immediately change the temporary password to a strong password that meets the <br />following criteria: <br />a. Length - At least eight (8) characters in length or the maximum length permitted by the ORCA <br />system, whichever is shorter. <br />b. Elements - Contains one each of at least three (3) of the following four (4) elements: <br />1. English upper case letters (A, B, C...) <br />2. English lower case letters (a, b, c... ) <br />3. Westernized Arabic numbers: 0, 1, 2...9 <br />4. Special characters: (@, #, %... ) <br />1.3 The Business Account shall restrict access to the ORCA Business Account Website by providing its user id and <br />password to only the employee(s) who have a business "need to know" and who are authorized by the Business <br />Account as "system user(s)". <br />1 A Access to the ORCA Business Account Website is restricted to the purpose of authorized administrative support <br />for the ORCA Business Account program <br />1.5 The Business Account's password shall be changed at least quarterly but also immediately upon (a) a system <br />user leaving the Business Account's employment or otherwise losing his/her status as an authorized user; and (b) the <br />Business Account learning that the password has been obtained by unauthorized persons or entities. <br />1.6 The Business Account's Primary Contact will review security policies and guidelines with system users at least <br />quarterly. <br />2.0 Physical Security <br />2.1 The Business Account shall require system users, when not at their workstations, to log off the Business <br />Account Website, or lock their screen using a password protected screen -saver in order to prevent unauthorized <br />access. <br />2.2 ORCA card stock shall be kept in a secure/locked location with access limited to those administering the <br />program. <br />2.3 The Business Account shall require its employees to keep printed reports containing account information in a <br />secure location. <br />3.0 Incident Management <br />3.1 The Business Account shall report any security incident or suspected incident immediately to the Lead Agency. <br />Examples of possible security incidents would be: introduction of computer viruses, unauthorized transactions or <br />blocked cards, or lost or stolen card stock. <br />ORCA Passport Agreement <br />City of Tukwila - BAID: <br />January 1, 2020 - December 31, 2020 <br />Page 20 of 23 <br />22 <br />