Exhibit 5 - ITSSEC01 - AGO Products and Services Acknowledgement ITS - Rev. 05-30-2025.pdf

Information Technology Services Office of the Chief Information Officer 30 East Broad Street, 14th Floor Columbus, Ohio 43215 www.OhioAttorneyGeneral.gov Office 614-466-5272 Fax 614-644-2055

Form ITSSEC01 Rev. 05-30-2025

THIS ACKNOWLEGEMENT SUPERSEDES ANY PREVIOUS ACKNOWLEDGEMENT AND WILL REMAIN IN EFFECT

UNTIL CANCELED OR HERAFTER SUPERSEDED.

Ohio Attorney General Request for

Non-Interactive or Service Account User Acknowledgement

The purpose of this Acknowledgement is to ensure that any individual (the “User”) requesting an account to access Products and Services of the Ohio Attorney General (“AGO”) becomes familiar with and acknowledges awareness of this Standards of Conduct Policy (the “Policy”) when connecting to the AGO network from any host to utilize AGO Products and Services. This Policy is designed to minimize the AGO and the State of Ohio’s potential exposure to damage which may result from unauthorized use of AGO Products and Services. Such damages include, but are not limited to, the loss or dissemination of sensitive or confidential data, loss or dissemination of intellectual property, damage to public image, and damage to critical AGO internal systems. Any violation of this Policy may result in immediate termination of User access to any or all AGO Products and Services and notification of the violation to the User’s employer signing this Policy in conjunction with the User. All Users will be held personally responsible and liable, to the fullest extent of the law, for actions in violation of this Policy or governing regulations and law based on the classifications of data. The specific classifications of data the User is authorized to work with will be defined in the contract, memorandum of understanding, or retention agreement defining the governing policies, laws, and regulations.

This form is intended for service or non-interactive user accounts. This is not for individual users who access services interactively, form ITSSEC03 should be used for that purpose.

Services and Data of the AGO means information and information systems owned, managed, or for which the AGO is responsible. The User will identify the systems, services, and data access requested below, which will be defined in the contract, memorandum of understanding, or retention agreement with the AGO.

• All AGO network services and data may include, but is not limited to, FTPS, e-mail, source data, database services, applications, and user account management on AGO electronic networks, etc.

• Data is any data provided by the AGO for any purpose, which may include sensitive protected data classifications. These classifications may include but are not limited to PII, CPI, FTI, CJI, PHI, etc.

Details should be included in the MOU or contract under which this access is being requested.

In order to comply with applicable policy, regulations, and law and to ensure the security and integrity of the Services and Data of the AGO, the User shall:

• Utilize the Products and Services of the AGO and any information/data provided therefrom for authorized uses exclusively, o Authorized use is limited to the business need of the User and Employer, as defined by the Memorandum of Understanding (MOU), or Contract for which this access is requested.

• Protect against improper access, use, loss alteration or destruction of any AGO data. Examples of this protection include, but are not limited to:

o Never sharing account credentials, http://www.ohioattorneygeneral.gov/

UNTIL CANCELED OR HERAFTER SUPERSEDED.

o Reporting if the account has rights beyond those necessary to complete the work, o Lock or log out of workstations when not actively using them with the Employer issued credential, o Only using data or access to the data for the express authorized purpose, o Ensuring data is not copied or does not leave the work environment.

• User shall promptly notify Employer’s Information Technology or IT Security department, as directed by the Employer, of events that may compromise Products and Services of the AGO. Employer shall then promptly notify the AGO if a Security Event has occurred or if suspicion of a Security Event has been identified. A Security Event includes, but is not limited to:

o Any abnormality in the environment that could lead to a compromise of the system integrity or result in disclosure of data, o System failures, and o Lost/stolen laptop or media.

• Create a password in compliance with the AGO password criteria set forth below. The AGO reserves the right to change the password criteria from time to time. Compliance with the AGO password criteria will be enforced via automated password authentication or public/private keys with strong passphrases. The AGO password criteria are as follows:

o Minimum password length: 20 o Must include 3 of the 4: a-z, A-Z, 0-9, and special characters, o Minimum password age(days): 2 o Maximum password age(days): 365 o Number of failed logon attempts allowed: 3 o Accounts will be locked out for a duration(mins): 30 o Passwords will require being reset based on level of access at the AGO’s discretion, o Passwords must be kept securely by the account owner, and never be shared, o Passwords must not contain sequences 01, 123, abc, etc., o Passwords must not contain properly spelled dictionary words, and o Passwords must not be directly identifiable to the user (e.g. social security number, date of birth, spouse’s name, username, etc.).

Password history will be retained for 24 changes to ensure unique passwords. Inactive accounts will be disabled at 60 days and removed at 120 days. Users of accounts that reach 120 days of inactivity must reapply for an account.

• Comply with all federal, Ohio and any other law, as applicable, including, but not limited to: Internal Revenue Service Publication 1075 which is based on United States Code Title 26, Section 6103; Ohio Revised Code Chapter 1347; the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the associated omnibus rule to modify the HIPAA Privacy, Security and Enforcement Rules; and the Health information Technology for Economic and Clinical Health (“HITECH”) Act, the CJIS Security Policy, and other relevant policies which are based on Title 28, Code of Federal Regulations, Part 20; as applicable based on the classifications of data share. The specific classifications of data the User is authorized to work with will be defined in the contract, memorandum of understanding, or retention agreement defining the User’s authorized work and uses.

UNTIL CANCELED OR HERAFTER SUPERSEDED.

USER’S UNDERSTANDINGS:

While connected to or utilizing AGO Products and Services:

• User understands that any Users who engage in electronic communications with people or entities in other states or countries, or on other systems or networks, are on notice that they may also be subject to the laws of those other states and countries and the rules and policies of those other systems and networks. Users are responsible for obtaining, understanding, and complying with the laws, rules, policies, contracts, and licenses applicable to their authorized uses.

• User understands that the AGO retains the right, and has the capability, among other security measures, to review, audit or monitor the User’s directories, files, e-mails (both sent and received), as well as Internet usage from any AGO system or service to ensure maintenance of system integrity. User also understands that User’s access to the Products and Services is subject to termination for breach of this Policy at any point.

• User understands that, among other security measures, the AGO makes backup copies and stores User information. User activities are therefore not private, and User content is potentially stored on AGO servers. User also understands that the AGO is subject to public records disclosure and to discovery requests and that User’s activities and information may be released pursuant to a public records or discovery request.

PROHIBITED ACTIVITIES:

Unless specifically authorized in the contract, memorandum of understanding, or retention agreement User shall not engage in any of the following activities while connected to or utilizing Services or Data of the AGO.

• Engage in illegal, fraudulent, or malicious conduct;

• Share AGO issued credentials with any person or entity for any reason;

• Leave a computer unattended for any period of time unless it is secured in such a way that the computer cannot be accessed by any unauthorized individual (e.g. sign-off procedure, password protected screen saver, etc.).

• Monitor or intercept the files or electronic communications of AGO employees or any other third parties, while connected;

• Test, circumvent, or defeat the security systems of the AGO or any other organization;

• Access or attempt to access the AGO or any other organizations’ systems without prior authorization from the AGO;

• Provide unauthorized access to or disseminate any Services and Data of the AGO, regardless of whether it is considered confidential or public, and regardless of how the information was obtained, without prior authorization from the AGO.

• Make paper, electronic, or any other copies of any AGO data, regardless of how the information was obtained.

User Acknowledgement By signing below, you, as a User, acknowledge that you have read and understand this Policy, and you, the User, agree to comply with the terms of this Policy. Please complete all blank portions of the form below.

Printed Name of User: Title:

User’s Employer: Contract End Date:

User’s Phone Number: User’s E-mail:

UNTIL CANCELED OR HERAFTER SUPERSEDED.

Requested Period of Access:

From: _______________ To: ______________________________

Application or resources requested: (Secure FTP, Edisp, Livescan, etc.):

Public IP:

User’s Signature: Date:

Account Identity Control Information (1):

Account Identity Control Information (2):

(e.g., mother’s maiden name, etc.)

(e.g., first car owned, etc

The above Account Identity Control Information will be used to identify you in the event that you have lost or do not remember your account ID or password. The User must provide two unique pieces of information as a shared secret with the AGO to verify your identity when account resets and other services that require identity verification are needed. It is the User’s obligation to provide and secure these shared secrets in the same manner that is required for account credentials.

Employer Acknowledgement Employer acknowledges an understanding of and responsibility to:

• Take reasonable precautions to ensure that the computer used to connect to AGO Products and Services is secure and free of malicious code. Examples of reasonable precautions include, but are not limited to:

o Ensure workspaces are set up to prevent passersby from viewing any information, o Endpoint protection (e.g. anti-malware, user controls, etc.), o Perimeter protection (e.g. firewall, Host/Network Intrusion Detection System, Host/Network Intrusion Protection System, Demilitarized Zone, Universal Threat Management, etc.), o Audit logs, o Adequate physical security for data and systems, o System monitoring and auditing of the logs, o Incident response policy, and o Data safeguarding procedures appropriate for the type of data and access.

• Promptly notify the AGO of the date of separation if User leaves the employer or if access to AGO networks, applications, systems and/or AGO data is no longer required. Access to AGO Products and Services may be rescinded for failure to provide such notice.

• Comply with all applicable contracts and licenses, as applicable, where the User or Employer has introduced applications or third-parties to the AGO provided services.

• Employer shall promptly notify the AGO if a Security Event has occurred or if suspicion of a Security Event has been identified. Security Event includes, but is not limited to:

UNTIL CANCELED OR HERAFTER SUPERSEDED.

o Any abnormality in the environment that could lead to a compromise of the system integrity or result in disclosure of data, o Changes in security infrastructure, o Compromised user accounts o Hack attempts, o Malware, o System failures, and o Lost/stolen laptop or media.

• Employer understands that all Users will be fully held responsible and liable of the law for actions while using the Services and Data of the AGO.

By signing below, you, as the User’s employer, acknowledge that you are a duly authorized representative of the User’s employer able to bind the employer to the terms of this Acknowledgement, and the standards herein, and to monitor and enforce the terms of this policy. By signing below, you, as the User’s employer, also agree that access by the employer may be rescinded at the discretion of the AGO, with prior notice, if the employer fails to take reasonable precautions, as defined above, to avoid a breach of this Policy and/or to ensure that the employer’s Users do not breach this, Policy.

Printed Name: ______________________________________

Employer’s Signature: _________________________________

Employer’s Phone Number: ____________________________

Employer’s E-mail: ___________________________________

Title: __________________________

Date: __________________________

Official AGO Use Only:

AGO Contract #:

AGO ITS Work Order Number:

AGO issued username:

AGO issued rights:

AGO Chief Information Officer, Chief Information Security Officer, or their designee

Name: Title:

Signature: Date:

Comments: