Laserfiche WebLink
Security Policies and Procedures <br />Access at a temporary privileged user level shall be granted only on a need -to -know, <br />need -to -perform basis, and then only to the assets required. Temporary privileged user <br />access shall only be granted to those supporting Virtru's applications, networks and <br />systems. <br />D. Assignment and Revocation Procedure <br />The ISO shall electronically complete: <br />1. An Employee Access Log for all new hires and/or workforce member change <br />of status. <br />2. An Exit Checklist for all terminations. <br />E. Logout After Inactivity <br />The ISO shall verify that all users have activated a password -protected screensaver that <br />automatically prevents unauthorized users from viewing or accessing electronic <br />protected information from any system or device that can be used to access electronic <br />information systems. After a maximum of 10 minutes of inactivity the system should <br />log off and lock the device, making information inaccessible. Once logged off a user <br />must re-enter a password to gain access to electronic protected information. <br />XIV. Breaches or Impermissible Uses/Disclosures <br />A. Definitions <br />Incident is defined as any breach of security, privacy, continuity, legal or regulatory <br />controls over information assets of any type. Examples of such incidents include but are <br />not limited to: <br />1. Penetrations of systems, applications, networks or databases <br />2. Denial of service attacks <br />3. Misuse or mishandling of assets <br />4. Virus or other malware contamination <br />5. Transaction errors <br />6. Breaches of confidentiality agreements or contracts <br />7. Legal or regulatory violations <br />Breach is defined as an impermissible access, use or disclosure, which compromises the <br />privacy or security of PHI. <br />Rev.2015.8.6 <br />31 <br />