Exhibit 4 - ITSSEC03 - Non-vendor network access acknowledgement ITS - Rev. 03-17-2025.pdf

Information Technology Services Office of the Chief Information Officer 30 East Broad Street, 14th Floor Columbus, Ohio 43215 www.OhioAttorneyGeneral.gov Office 614-466-5272 Fax 614-644-2055

Form ITSSEC03 Rev. 03-17-2025

THIS ACKNOWLEGEMENT SUPERSEDES ANY PREVIOUS ACKNOWLEDGEMENT AND WILL REMAIN IN EFFECT

UNTIL CANCELED OR HERAFTER SUPERSEDED.

Ohio Attorney General Non-Employee Off-Premises

Network Access Policy Acknowledgement

This Ohio Attorney General (“AGO”) Non-Employee Off-Premises Network Access Policy Acknowledgement (the “Acknowledgement”) sets forth the policies and procedures for network use by all non-AGO personnel and their employers accessing the AGO’s network (each a “User”) while off-premises. Any violation of this Policy may result in, among other penalties and liabilities, immediate removal of User access to all AGO systems and notification to the User’s employer of the violation. The AGO may temporarily suspend or block a User’s access to an account when it appears reasonably necessary to do so to protect the security of the AGO network or to protect the AGO from liability. All Users will be held personally responsible and liable, to the fullest extent of the law, for actions in violation of this Policy or governing regulations and law based on the classifications of data. The specific classifications of data the User is authorized to work with will be defined in the contract, memorandum of understanding, or retention agreement defining the governing policies, laws, and regulations.

This form is intended for individual users who access services interactively and remotely. This is not for service or non-interactive accounts, form ITSSEC01 should be used for that purpose.

Services and Data of the AGO means information and information systems owned, managed, or for which the AGO is responsible. The User will identify the systems, services, and data access requested below which will be defined in the contract, memorandum of understanding, or retention agreement with the AGO.

• All AGO network services and data which may include, but is not limited to, FTPS, e-mail, source data, database services, applications, and user account management on AGO electronic networks, etc.

• Data is any data provided by the AGO for any purpose, which may include sensitive protected data classifications. These classifications may include but are not limited to PII, CPI, FTI, CJI, PHI, etc.

details should be included in the MOU or contract under which this access is being requested.

I. NETWORK ACCESS POLICY

In order to comply with applicable policy, regulations, and law and to ensure the security and integrity of the Services and Data of the AGO, the User shall:

• Acknowledge they have been provided with and will comply with the provisions of this Policy;

• Utilize the Services and Data of the AGO and any information/data provided therefrom for authorized use only;

o Authorized use is limited to the business need of the User and Employer, as defined by the Memorandum of Understanding (MOU) or Contract for which this access is being requested

• Immediately notify the AGO by way of the User’s Employer of any proven or suspected unauthorized disclosure of Services or Data of the AGO;

• Promptly notify User’s Employer’s Information Technology or IT Security, as directed by the User’s Employer, of events below. Employer shall then promptly notify the AGO if a Security Event has http://www.ohioattorneygeneral.gov/ occurred or if suspicion of a Security Event has been identified. A Security Event includes, but is not limited to:

o Any abnormality in the environment that could lead to a compromise of the system integrity or result in disclosure of data, o Hack attempts, o Malware, o Compromised accounts with access to Services and Data of the AGO; and

Lost/stolen laptop or media that may contain or is able to access Services and Data of the AGO.

• Take all reasonable precautions to prevent the dissemination of User’s credentials by any means, including, but not limited to, not sharing the User’s username and password, not writing down the username and password, etc.;

• Not circumvent password compliance for accounts with access to Serviced and Data of the AGO. AGO password criteria set forth below. The AGO reserves the right to change the password criteria from time to time. Compliance with the AGO password criteria will be enforced via automated password authentication or public/private keys with strong passphrases. The AGO password criteria are as follows:

o Minimum 14 characters, o Must include 3 of the 4: a-z, A-Z, 0-9, and special characters, o Passwords will require being reset based on level of access at the AGO’s discretion, o Passwords must be kept securely by the account owner, and never be shared, o Passwords must not contain sequences 01, 123, abc, etc., o Passwords must not contain properly spelled dictionary words, and o Passwords must not be directly identifiable to the user (e.g. social security number, date of birth, spouse’s name, username, etc.).

Password history will be retained by AGO for 24 changes to ensure unique passwords. Inactive accounts will be disabled at 90 days, and access removed at 120 days. Users of accounts that reach 120 days of inactivity must reapply for an account;

• Comply with all applicable network or operating system restrictions, whether or not they are built into the operating system or network, and whether or not they can be circumvented by technical means as applicable when accessing Service and Data of the AGO;

• Comply with all federal, Ohio, and any other law, as applicable, including, but not limited to: Internal Revenue Service Publication 1075 which is based on United States Code Title 26, Section 6103; Ohio Revised Code Chapter 1347; the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the associated omnibus rule to modify the HIPAA Privacy, Security and Enforcement Rules; Health information Technology for Economic and Clinical Health (“HITECH”) Act; the CJIS Security Policy, and other relevant policies which are based on Title 28, Code of Federal Regulations, Part 20; or as applicable based on the classifications of data used with AGO Services and Data. The specific classifications of data the User is authorized to work with will be defined in the contract, memorandum of understanding, or retention agreement defining the User’s authorized work and uses.

User shall not, without prior authorization from the AGO, or as provided in the MOU or Contract:

• Move, alter, delete, copy, or otherwise change any information/data stored or contained on the AGO network without express, written authorization by the AGO (e.g. a written agreement, scope of work, or AGO approved amendment to the original written agreement).

• Leave a computer that is logged into the AGO network unattended for any period of time unless it is secured in such a way that the computer cannot be used by any other individual (e.g. sign-off procedure, password protected screen saver, etc.);

• Make paper, electronic, or any other copies or reproductions of any AGO information/data or licensed materials, regardless of how the information/data or materials were obtained, without prior authorization from the AGO or as defined in the written agreement with the AGO for which this access is begin requested;

• Use a username other than the User’s AGO issued credentials when accessing Systems and Data of the

AGO;

• Share any information/data gained through use of AGO networks with anyone outside the AGO without prior authorization from the AGO.

II. USER’S UNDERSTANDINGS

While connected to or utilizing AGO Services or Data, User understands that any User who engages in electronic communications with people or entities in other states or countries, or on other systems or networks, are on notice that they may also be subject to the laws of those other states and countries and the rules and policies of those other systems and networks. User is responsible for obtaining, understanding, and complying with the laws, rules, policies, contracts, and licenses applicable to their particular uses.

• User understands that the confidentiality and privileged nature of Services and Data of the AGO must be respected and protected. User understands that the AGO retains the right and has the capability, among other security measures, to review, audit, or monitor the User’s directories, files, e-mails (both sent and received) from any AGO system or service to ensure maintenance of information/data integrity. User also understands that the AGO has the right to remove or destroy unauthorized materials found on AGO networks and to terminate the User’s relationship with the AGO for breach of this Policy.

• User understands that, among other security measures, the AGO makes backup copies and stores User information. User activities are therefore not private and User content is potentially stored on AGO servers.

User also understands that the AGO is subject to public records disclosure and to discovery requests and that the User’s activities and information may be released pursuant to a public records or discovery request.

III. PROHIBITED ACTIVITIES:

Unless specifically authorized in the contract, memorandum of understanding, or retention agreement User shall not engage in any of the following activities while connected to or utilizing Services or Data of the AGO.

• Engage in illegal, fraudulent, or malicious conduct;

• Share AGO issued credentials with any person or entity for any reason;

• Leave a computer unattended for any period of time unless it is secured in such a way that the computer cannot be accessed by any unauthorized individual (e.g. sign-off procedure, password protected screen saver, etc.).

• Monitor or intercept the files or electronic communications of AGO employees or any other third parties, while connected;

• Test, circumvent, or defeat the security systems of the AGO or any other organization;

• Access or attempt to access the AGO or any other organizations’ systems without prior authorization from the AGO;

• Provide unauthorized access to or disseminate any Services and Data of the AGO, regardless of whether it is considered confidential or public, and regardless of how the information was obtained, without prior authorization from the AGO.

• Make paper, electronic, or any other copies of any AGO data, regardless of how the information was obtained.

User Acknowledgement By signing below, you, as a User, acknowledge that you have read and understand this Policy, and you, the User, agree to comply with the terms of this Policy. Please complete all blank portions of the form below.

Printed Name of User: _________________________ Title: _________________________________

User’s Employer: _____________________________ Contract End Date: ______________________

User’s Phone Number: _________________________ User’s E-mail: ___________________________

Requested Period of Access:

From: ______________________________________ To: ___________________________________

Application or resources requested: (VPN, AGO Domain Account, systems or service, etc.)

Public IP: ___________________________________

User’s Signature: ______________________________ Date: _________________________________

Account Identity Control Information (1):________________________(e.g., mother’s maiden name, etc.)

Account Identity Control Information (2):________________________(e.g., first car owned, etc.)

The above Account Identity Control Information will be used to identify you in the event that you have lost or do not remember your account ID or password. The User must provide two unique pieces of information as a shared secret with the AGO to verify your identity when your account resets and other services that require identity verification are needed. It is the User’s obligation to provide and secure these shared secrets in the same manner that is required for account credentials.

Employer Acknowledgement Employer acknowledges an understanding of and responsibility to:

• Take reasonable precautions to ensure that the computer used to connect to AGO Products and Services is secure and free of malicious code. Examples of reasonable precautions include, but are not limited to:

o Ensure workspaces are set up to prevent passersby from viewing any information, o Endpoint protection (e.g. anti-malware, user controls, etc.), o Perimeter protection (e.g. firewall, Host/Network Intrusion Detection System, Host/Network Intrusion Protection System, Demilitarized Zone, Universal Threat Management, etc.), o Audit logs, o Adequate physical security for data and systems, o System monitoring and auditing of the logs, o Incident response policy, and o Data safeguarding procedures appropriate for the type of data and access.

• Promptly notify the AGO of the date of separation if User leaves the employer or if access to AGO networks, applications, systems and/or AGO data is no longer required. Access to AGO Products and Services may be rescinded for failure to provide such notice.

• Comply with all applicable contracts and licenses, as applicable, where the User or Employer has introduced applications or third parties to the AGO provided services.

• Employers shall promptly notify the AGO if a Security Event has occurred or if suspicion of a Security Event has been identified. Security Event includes, but is not limited to:

o Any abnormality in the environment that could lead to a compromise of the system integrity or result in disclosure of data, o Changes in security infrastructure, o Compromised user accounts o Hack attempts, o Malware, o System failures, and o Lost/stolen laptop or media.

• Employer understands that all Users will be fully held responsible and liable of the law for actions while using the Services and Data of the AGO.

By signing below, you, as the User’s employer, acknowledge that you are a duly authorized representative of the User’s employer able to bind the employer to the terms of this Acknowledgement, and the standards herein, and to monitor and enforce the terms of this policy. By signing below, you, as the User’s employer, also agree that access by the employer may be rescinded at the discretion of the AGO, with prior notice, if the employer fails to take reasonable precautions, as defined above, to avoid a breach of this Policy and/or to ensure that the employer’s Users do not breach this, Policy.

Printed Name: ______________________________________

Employer’s Signature: _________________________________

Employer’s Phone Number: ____________________________

Employer’s E-mail: ___________________________________

Title: __________________________

Date: __________________________

Official AGO Use Only:

AGO Contract #:

AGO ITS Work Order Number:

AGO issued username:

AGO issued rights:

AGO Chief Information Officer, Chief Information Security Officer, or their designee

Name: Title:

Signature: Date:

Comments: