Common use of User IDs and Password Controls Clause in Contracts

User IDs and Password Controls. i. All users must be issued a unique username for accessing PII. ii. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee within twenty-four (24) hours. Note: Twenty-four (24) hours is defined as one (1) working day. iii. Passwords are not to be shared. iv. Passwords must be at least eight (8) characters. v. Passwords must be a non-dictionary word. vi. Passwords must not be stored in readable format on the computer or server. vii. Passwords must be changed every ninety (90) days or less. viii. Passwords must be changed if revealed or compromised. ix. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. Upper case letters (A-Z) B. Lower case letters (a-z) C. Arabic numerals (0-9)

User IDs and Password Controls. i. 1. All users must be issued a unique username user name for accessing PII. ii2. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee within twenty-twenty- four (24) hours. Note: Twenty-four (24) hours is defined as one (1) working day. iii3. Passwords are not to be shared. iv4. Passwords must be at least eight (8) characters. v. 5. Passwords must be a non-dictionary word. vi6. Passwords must not be stored in readable format on the computer or server. vii7. Passwords must be changed every ninety (90) days or less. It is recommended that passwords be required to be changed every sixty (60) days or less. viii8. Passwords must be changed if revealed or compromised. ix9. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. a. Upper case letters (A-Z) B. b. Lower case letters (a-z) C. ) c. Arabic numerals (0-9) d. Special characters (!,@,#, etc.)

User IDs and Password Controls. i. All users must be issued a unique username user name for accessing PII. ii. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee within twenty-four (24) hours. Note: Twenty-Twenty- four (24) hours is defined as one (1) working day. iii. Passwords are not to be shared. iv. Passwords must be at least eight (8) characters. v. Passwords must be a non-dictionary word. vi. Passwords must not be stored in readable format on the computer or server. vii. Passwords must be changed every ninety (90) days or less. viii. Passwords must be changed if revealed or compromised. ix. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. Upper case letters (A-Z) B. Lower case letters (a-z) C. Arabic numerals (0-9) D. Special characters (!,@,#, etc.)

User IDs and Password Controls. i. All users must be issued a unique username for accessing PII. ii. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee within twenty-four (24) hours. Note: Twenty-four (24) hours is defined as one (1) working day. iii. Passwords are not to be shared. iv. Passwords must be at least eight (8) characters. v. Passwords must be a non-dictionary word. vi. Passwords must not be stored in readable format on the computer or server. vii. Passwords must be changed every ninety (90) days or lessin accordance with NIST standards. viii. Passwords must be changed if revealed or compromised. ix. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. Upper case letters (A-Z) B. Lower case letters (a-z) C. Arabic numerals (0-9)

User IDs and Password Controls. i. 1. All users must be issued a unique username user name for accessing Medi-Cal PII. ii2. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee employee, at maximum within twenty-four (24) 24 hours. Note: Twenty-four (24) hours is defined as one (1) working day. iii3. Passwords are not to be shared. iv4. Passwords must be at least eight (8) characters. v. 5. Passwords must be a non-dictionary word. vi6. Passwords must not be stored in readable format on the computer or server. vii7. Passwords must be changed every ninety (90) 90 days or less. It is recommended that passwords be required to be changed every 60 days or less. viii8. Passwords must be changed if revealed or compromised. ix9. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. a. Upper case letters (A-Z) B. b. Lower case letters (a-z) C. c. Arabic numerals (0-9) d. Special characters

User IDs and Password Controls. i. All users must be issued a unique username user name for accessing PII. ii. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee within twenty-four (24) hours. Note: Twenty-Twenty- four (24) hours is defined as one (1) working day. iii. Passwords are not to be shared. iv. Passwords must be at least eight (8) characters. v. Passwords must be a non-dictionary word. vi. Passwords must not be stored in readable format on the computer or server. vii. Passwords must be changed every ninety (90) days or less. viii. Passwords must be changed if revealed or compromised. ix. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. Upper case letters (A-Z) B. Lower case letters (a-z) Exhibit N_Privacy & Security Agreement._rev 08.2021 C. Arabic numerals (0-9) D. Special characters (!,@,#, etc.)

User IDs and Password Controls. i. 1. All users must be issued a unique username user name for accessing Medi-Cal PII. ii2. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee employee, at maximum within twenty-twenty- four (24) hours. Note: Twenty-four (24) hours is defined as one (1) working day. iii3. Passwords are not to be shared. iv4. Passwords must be at least eight (8) characters. v. 5. Passwords must be a non-dictionary word. vi6. Passwords must not be stored in readable format on the computer or server. vii7. Passwords must be changed every ninety (90) days or less. It is recommended that passwords be required to be changed every sixty (60) days or less. viii8. Passwords must be changed if revealed or compromised. ix9. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. a. Upper case letters (A-Z) B. b. Lower case letters (a-z) C. ) c. Arabic numerals (0-9) d. Special characters (!,@,#, etc.)

User IDs and Password Controls. i. All users must be issued a unique username for accessing PII. ii. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee within twenty-four (24) hours. Note: Twenty-Twenty- four (24) hours is defined as one (1) working day. iii. Passwords are not to be shared. iv. Passwords must be at least eight (8) characters. v. Passwords must be a non-dictionary word. vi. Passwords must not be stored in readable format on the computer or server. vii. Passwords must be changed every ninety (90) days or less. viii. Passwords must be changed if revealed or compromised. ix. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. Upper case letters (A-Z) B. Lower case letters (a-z) C. Arabic numerals (0-9)

User IDs and Password Controls. i. All users must be issued a unique username for accessing PII. ii. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee within twenty-four (24) hours. Note: Twenty-four (24) hours is defined as one (1) working day. iii. Passwords are not to be shared. iv. Passwords must be at least eight (8) characters. v. Passwords must be a non-dictionary word. vi. Passwords must not be stored in readable format on the computer or server. vii. Passwords must be changed every ninety (90) days or less. viii. Passwords must be changed if revealed or compromised. ix. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. x. Upper case letters (A-Z) B. xi. Lower case letters (a-z) C. xii. Arabic numerals (0-9) xiii. Special characters (!,@,#, etc.)

User IDs and Password Controls. i. All users must be issued a unique username user name for accessing PII. iiPHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee with knowledge of the password, at maximum within twenty-four (24) hours. Note: Twenty-four (24) hours is defined as one (1) working day. iii. Passwords are not to be shared. iv. Passwords must be at least eight (8) characters. v. Passwords characters and must be a non-dictionary word. vi. Passwords must not be stored in readable format on the computer or server. viicomputer. Passwords must be changed every ninety (90) days or less. viiidays, preferably every sixty (60) days. Passwords must be changed if revealed or compromised. ix. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. 1) Upper case letters (A-Z) B. 2) Lower case letters (a-z) 3) C. Arabic numerals (0-9) 4) Non-alphanumeric characters (punctuation symbols)

User IDs and Password Controls. i. 1. All users must be issued a unique username user name for accessing Medi-Cal PII. ii2. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee employee, at maximum within twenty-four (24) 24 hours. Note: Twenty-four (24) hours is defined as one (1) working day. iii3. Passwords are not to be shared. iv4. Passwords must be at least eight (8) characters. v. 5. Passwords must be a non-dictionary word. vi6. Passwords must not be stored in readable format on the computer or server. vii7. Passwords must be changed every ninety (90) 90 days or less. It is recommended that passwords be required to be changed every 60 days or less. viii8. Passwords must be changed if revealed or compromised. ix9. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. a. Upper case letters (A-Z) B. b. Lower case letters (a-z) C. c. Arabic numerals (0-9)

User IDs and Password Controls. i. All users must be issued a unique username for accessing PII. ii. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee within twenty-four (24) hours. Note: Twenty-four (24) hours is defined as one (1) working day. iii. Passwords are not to be shared. iv. Passwords must be at least eight (8) characters. v. Passwords must be a non-dictionary word. vi. Passwords must not be stored in readable format on the computer or server. vii. Passwords must be changed every ninety (90) days or less. viii. Passwords must be changed if revealed or compromised. ix. Passwords must be composed of characters from at least three (3) of the following four (4) groups from the standard keyboard: A. Upper case letters (A-Z) B. Lower case letters (a-z) ) C. Arabic numerals (0-9) D. Special characters (!,@,#, etc.)