2017-212-E CJRM - Automon LLC for Criminal Justice Resource Management (CJRM) Case Management Software

Browse Search

DocuSign Envelope ID:D164BE86-F785-4067-B01F-BFFEBB5FF1B9 to be compliant with Federal and State laws where it operates. Further, the certifications it maintains (e.g. Fed Ramp, DOD and CJIS) impose in some cases more stringent policies. The incident management and reporting are updated from time to time as laws change and best practices evolve. 24. What is the process by which the cloud provider updates policies and informs customers? Microsoft publishes on its website the policies. As those policies change, the website is updated to reflect those changes. 25. What is the basic architecture of the cloud provider's network security? (overall design, zones, filters, firewalls, VLANs,protocols, standards) Microsoft Azure Government maintains state of the art architecture for network security. A basic outline of that architecture is available online,but some, if much of about its architecture, it internal features, redundancy and operations remains confidential and propriety. 26. What security measures does the cloud provider use in data storage, transit and use? Ce Pretrial makes use of TLS for all data in transit, including data in transit between the client browser and web servers, and as well as for data in transit between the web servers and database servers. The backend web servers, SQL Azure and Azure blob storage operate with TDE (SQL's Transparent Data Encryption) turned on to protect data at rest. All customer data is stored on Microsoft Azure Government platform. 27. What encryption technologies does the cloud provider use in data management? See answer to Question 26. Ce Pretrial uses TLS for data in transit and TDE for data at rest. 28. How are access rights managed by the cloud provider for their employees, contractors and other persons? Microsoft Azure Government publishes the conditions for employment and the access rights of classes of persons who have access to a customer database servers. 29. What methods does the cloud provider use to destroy information, when so authorized? Microsoft Azure Government publishes here a description of the process it uses for data cleaning and leakage: https://blogs.msdn.microsoft.com/walterm/2014/09/04/microsoft- azure-data-security-data-cleansing-and-leakage/ 30. What is the cloud provider's patch management policy/methods? See Master Subscription Agreement and AutoMon's Software maintenance Handbook. Patches and updates are typically perform after and before business hours to minimize potential downtime. In emergency situations, updates, restores and error corrections may be performed during normal business hours. When such an emergency occurs, AutoMon attempts to provide prior notice to the customer and consult with the customer regarding the schedule. AutoMon funnels communication through the customer designated representative, who communicates with customer staff.