Laserfiche WebLink
City of Tukwila My WebLink |HelpSearch Tips |About |Sign Out
Exhibit C <br /> PCI Security Specifications <br /> The Agency shall be responsible for Information Technology (IT) security for all personnel with access to the <br /> Agency network, systems connected to the Agency network or those systems developed and /or operated by the <br /> Agency. <br /> This includes but is not limited to information technology, hardware, software, and the management, operation, <br /> maintenance, programming, and system administration of computer systems, networks, and telecommunications <br /> systems. <br /> Examples of tasks that require security provisions include but are not limited to acquisition, transmission or <br /> analysis of data owned by Agency and /or OPC or access to Agency networks or computers at a level beyond that <br /> granted the general public, e.g., bypassing the Agency firewall. <br /> Agency its subcontractors, and the employees of each shall sign a confidentiality agreement and /or submit to a <br /> background investigation at any time prior to or during the performance of this contract at the direction and <br /> discretion of Agency and /or OPC. <br /> Agency shall have a documented, implemented, and maintain an IT Security Plan for the duration of the <br /> contract. <br /> This Plan shall describe the processes, procedures and training of personnel that will be followed to ensure <br /> appropriate security of IT resources that are developed, processed, or transmitted during this contract. <br /> It must address the security measures and safeguards that will be provided to ensure privacy, confidentiality, and <br /> integrity of sensitive information. It must address the protection mechanisms used for unauthorized access, <br /> alternation, disclosure, or misuse of processed, stored, or transmitted information. <br /> Agency shall have appropriate technical, personnel, administrative, environmental, and access safeguards; and <br /> operate effectively and accurately. <br /> Agency shall comply with all PCI technical and physical security requirements, and shall ensure that <br /> connections to all Agency platforms, operating environments, and applications are protected to prevent <br /> unauthorized access and assure accountability, availability, and integrity. <br /> 11 <br />