3rd Party System Access Agreement 2022.docx

IT special contract terms menu Attachment __ – ACCESS POLICY

City of Fredericksburg Information Systems Access Policy

Purpose:

The purpose of this policy is to establish the rules for access to City of Fredericksburg information systems.

Scope:

This policy outlines the responsibilities of anyone other than a City employee that requires access to City information systems, such as software vendors, contractors, consultants, business partners, and security companies (referred to in this policy as “outside parties”). This policy also outlines the responsibilities of City employees responsible for the managing that access.

Policy:

Server Rooms Anyone accessing the City’s server rooms must follow the City’s Server Room Access Policy.

Third Party Policy Guidelines

1. All work by outside parties must be scheduled with and pre-approved by the City’s Information Technology Department. All configuration information of any installed software must be made available to IT. All installed software must be virus checked to IT’s standards.

2. Access will be permitted only to City information that has been pre-approved by IT.

3. Remote access must meet the following minimum security requirements:

· Remote support connections must be encrypted with a minimum of AES128 bit encryption.

· Remote support connections must have an inactivity timeout with a maximum of 15 minutes.

· Remote support connections must be configured to allow the City to monitor the remote session.

· Remote support access shall use as few rights as possible to complete the given task.

· Remote support access must be configured to allow the City to disconnect at any time.

· Remote support access must have an up-to-date and operational virus/malware scanner.

· Remote support access must be secured by either a software-based firewall installed on the computer or a hardware-based solution. It must be up-to-date and operational.

· Remote support must implement multi-factor authentication for access to any administrative portal and/or any remote administrative interface. Short Message Service (SMS) multifactor authentication is not permitted.

· Any special considerations must be approved by IT.

4. Outside parties accessing information the City deems confidential must execute the City’s standard Nondisclosure Agreement.

5. Any City information acquired by an outside party under a contract or other agreement with the City shall only be used for the purposes stated in that contract or agreement; it may not be used for an outside party’s own purposes or divulged to others.

6. All outside parties accessing City information systems shall comply with all applicable City standards and policies, such as policies on acceptable use, software licensing, safety, auditing, security, nondisclosure, and privacy. The City will provide these policies upon request.

7. The City may designate a member of the IT Department as the point of contact for outside parties accessing the City’s information systems.

8. Outside parties shall provide the City with a list of all its employees and all of its subcontractor’s employees that will be accessing the City’s systems. No person may access the City’s systems without the City’s advance written approval.

9. Each outside party’s access to systems must be uniquely identifiable and authenticated, and password management must comply with the City’s password policy. Managing connectivity with partner networks can be handled different ways depending on what technologies are in place (e.g. encryption, intrusion detection, DMZ architecture).

10. Any non-City computer or other device connected to the City’s systems must have up-to-date virus protection and patches. The Third Party shall be held accountable for any damage to the City’s network and/or data should it be determined that the incident was directly related to that Third Party’s access.

11. All outside party personnel working on City property must acquire a City ID badge to be displayed at all times while on the premises. The badge must be returned to the City upon termination or completion of the contract.

12. Upon request, outside parties shall provide documentation that their employees that have access to City confidential information have been cleared to handle that information. The City may perform background checks on any person seeking to access the City’s systems. Contractor will cooperate with the City on any requested background checks of its employees or subcontractors.

13. Outside parties must be able to explain how City information will be handled and protected when in the outside party is in possession of the information.

14. Outside parties must report all security incidents to City IT personnel.

15. Outside parties must follow all applicable change control procedures and processes.

16. All software used by outside parties in providing service to the City must be properly inventoried and licensed.

17. Outside parties must comply with all applicable auditing regulations and City auditing requirements.

18. Work outside of regular work hours must be pre-approved in writing by IT.

19. All outside party maintenance equipment on the City’s network that connects to the outside world shall remain disabled except when in use for authorized maintenance.

20. Upon termination or expiration of a contract between the City and an outside party, the outside party shall collect all confidential information, return it to the City or destroy it, and certify to the City that this has been done, within 48 hours. All equipment and supplies must also be returned, as well as any access cards and identification badges. All equipment and supplies retained by the outside party must be documented and authorized by the IT.

21. The City may monitor system and network log files.

22. The City will eliminate outside party’s access after the outside party’s contract has been completed or terminated. This includes:

• Removing the outside party’s authentication and all means of access to systems.

• If needed, ensure that incoming e-mail is re-routed to an appropriate person.

• Archiving any outside party software configuration, and transferring ownership to designated City staff.

• Obtain a written statement from the outside party that any software created or installed by the outside party is free of viruses and any other malicious code.

Non-Compliance Violations of this policy will be treated like other allegations of wrongdoing at the City of Fredericksburg. Allegations of misconduct will be adjudicated according to the City’s established procedures. Sanctions for inappropriate use of the City of Fredericksburg’s systems and services may include:

1. Temporary or permanent revocation of system access;

2. Determination of breach of contract;

3. Termination of contract; and

4. Legal action.

Third Party User Agreement I have read and understand the Third Party Access Policy. I understand if I violate the rules explained herein, I may face legal action according to applicable law.

Name: _______________________________________________

Signature: ____________________________________________

Date: ________________________________________________