Vendor_Contractor_Access_Policy.pdf
PDF 73 KB Posted
- Attached to
- E-Learning Course Authoring & Development
- Solicitation number
- 66000-2526-245
- Issued by
- San Mateo County, San Francisco City, California
About this file
This is a Vendor/Contractor Access Policy document established by San Mateo County, updated on October 22, 2018, that governs the terms and conditions for vendors and contractors requiring physical and network access to County facilities and information resources. The policy applies to all vendors and contractors who need access to County systems using non-County owned computing devices, including laptops and portable computing devices. The policy establishes comprehensive requirements for vendor and contractor conduct, including restrictions on information use to authorized business purposes only, mandatory employee access lists with 24-hour update requirements upon staff changes, data safeguarding obligations through encryption and device security, unique password management compliant with County IT Security Policy, prohibition of unlicensed or malicious software installation, and removal of all County-owned software upon service termination with written certification within 24 hours. Vendors and contractors must adhere to remote access procedures limiting usage to County system support, properly sanitize or destroy devices containing confidential information according to Department of Defense standards, maintain visible identification and comply with cardkey procedures, and obtain written authorization from the Chief Information Officer for data center access.
Vendors and contractors are responsible for ensuring anti-virus software with regular updates, current operating system security patches, and approved encryption programs meeting County IT Security Policy requirements are installed on all computing devices used for County business. Direct connection to the County network requires express written approval from the Chief Information Officer or designee, with vendors required to verify that devices have been properly patched, virus protected, and encrypted before network access is granted. Vendors using devices without approved software and encryption will be denied network access. Vendors and contractors must also maintain familiarity with and compliance to the County's IT Security Policy, Internet Usage Policy, Email Policy, Virus Patch and Vulnerability Management Policy, and Data Center Policy. Policy enforcement is administered by the Director of Information Systems Department (CIO), with Division Directors, Department Heads, and managers responsible for compliance within their respective areas. Violations may result in contract termination, denial of service, and criminal or civil legal penalties.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Vendor/Contractor Access Policy
Policy Update: 10/22/2018
Overview
Vendors/Contractors play an important role in the support of hardware and software management for San Mateo County. They may be required to access, configure, maintain, and provide emergency support for systems. As a result, the vendor/contractor can be exposed to sensitive data or the need to connect to the County’s network may expose the County to unwanted virus or security threats.
Policy Purpose
The purpose of this policy is to establish rules and responsibilities for the vendors/contractors who require not only physical access but also access to the County’s network and information resources. This policy is intended to minimize potential exposure from damages and to mitigate any liability to the County as a result of unauthorized use.
Scope
This policy applies to all vendors/contractors who require access to County facilities as well as access to the County’s network using non-County owned computing devices to perform work on behalf of the County. This policy also applies to all portable computers (laptops) and portable computing devices (devices that have similar hardware and software components used in personal computers such as a tablet PC).
Policy
Vendor/contractors shall:
A. Only use information and systems for the purpose of the business agreement with County and any information acquired in the course of the agreement shall not be used for personal purposes or divulged to others.
B. All contractors and vendors contracting with the County shall provide a list of its employees that require access to the County’s system and data pursuant to the agreement
1. The list shall be updated and provided to the Departments and Chief Information Officer (CIO) or his/her designee within 24 hours of staff changes.
C. Safeguard all County data by:
1. Utilizing data encryption to protect information on computing devices.
2. Securing the computing device at all times; especially if the device is left unattended for any length of time.
3. Implementing precautions to prevent others from viewing on-screen data in public areas.
4. Notifying the County immediately if the mobile device containing County data or used in the performance of County activities is lost or stolen.
5. Not downloading, uploading, or maintaining, on a computing device, any information that is considered sensitive without authorization of his/her Project Manager or Department Head or his/her designee.
D. Vendor/contractor shall use unique accounts and password management that complies with the County’s Information Technology (IT) Security Policy.
1. All passwords and accounts shall be unique to the vendor/contractor and shall not be shared.
E. Vendor/Contractor shall take reasonable steps to protect against the installation of unlicensed or malicious software.
1. All commercial software installed must have a valid license and that the terms, conditions, and copyright laws shall be strictly followed.
F. All County-owned software installed on the computing device must be removed when the vendor/contractor services are terminated.
1. Upon termination of work, the vendor/contractor shall return or destroy all County information and data as well as provide written certification of that return or destruction within 24 hours.
G. Remote access rules and procedures shall be strictly adhered to.
1. Remote access usage must be confined to provide support for County systems;
personal use shall be strictly prohibited.
H. In the event that a vendor/contractor disposes of a computing device containing County’s confidential information and/or data, the device must be sanitized in such a way that does not allow for the retrieval of data and by Department of Defense (DOD) standards.
1. Alternatively, computing devices may be physically destroyed by a method that leaves the device’s data unrecoverable.
I. Vendor/contractor understands that its written security protocols for County-related business shall be available for inspection by the County upon request.
1. For the period that the computing device is on the County’s network, there is no expectation of privacy with regard to the contents of the device despite the fact that it is a privately-owned equipment.
J. Vendors/contractors must wear visible identification and if issued a County cardkey, the cardkey must be visible at all times. Use of another individual’s cardkey is expressly prohibited.
K. Vendor/Contractor access to County data center(s) must be authorized and approved in writing by the Chief Information Officer (CIO) or his/her designee.
Responsibilities
The vendor/contractor will be responsible for assuring that anti-virus software, with scanning and update services be applied, is installed on its computing device used for County business and that the anti-virus software meets the requirements as set forth in the County’s IT Security Policy and the Virus, Patch, and Vulnerability Management Policy. Vendor must also ensure that all computing devices have operating system security patches installed and are updated on a regular basis.
Additionally, computing devices, such as laptops and/or tablets, must include an approved encryption program with configuration that meets or exceeds the County’s IT Security Policy.
Vendor/Contractor device(s) may connect directly to the County network with express written approval from the CIO or his/her designee. The Vendor/Contractor must verify to the County that the device(s) have been patched, virus protected, and encrypted. Vendors using devices without approved software and encryption will not be permitted to connect to the County’s network.
It is also the responsibility of the vendor/contractor to be familiar with the following policies to ensure its adherence:
• IT Security Policy
• Internet Usage Policy
• Email Policy (if applicable)
• Virus, Patch, and Vulnerability Management Policy
• Data Center Policy
Policy Enforcement
The Director of ISD (CIO) is the policy administrator for information technology resources and will ensure this process is followed. Additionally, Division Directors, Department Heads, and managers are responsible for compliance with County policy within their respective administrative areas.
Those vendors who violate this policy may be subject to contract termination, denial of service, and/or legal penalties, both criminal and civil.
Revision History
Effective Date Changes Made
November 1, 2004 Policy established
October 22, 2018 Policy updated
File details come from the government source that posted it. Updated .