This page uses extracted PDF text. Text can misread numbers, dates or table columns. Check the PDF before quoting or interpreting it. Redacted areas remain redacted.
Last Revised: March 11, 2021
Security Standards
Every user must have a unique username. No shared usernames should be required by the application.
Integration with City Active Directory is preferred for user authentication.
The following are enforced by Active Directory and should be supported by applications. If no
integration with Active Directory is available, the application must enforce these itself:
Password length of 12 characters and greater must be supported. Minimum password length
can be configured by the City.
Passwords must be complex. Windows password complexity rules preferred. Passwords must
contain 3 of the following 4 classes of characters – numeral, upper case letter, lower case letter,
special character.
Password expiration supported and configurable by the City
Password history supported and configurable by the City
User account lockout for excessive failed logon attempts supported and configurable by the City
All vendor supplied installation and administrative passwords must be changeable by the City. They
must be changed before going into production.
The application must support the principle of least privilege and provide for setting user access rights to
match the user’s role. For example, a user must not be required to have overall administrative rights to
perform non-administrative functions.
If PII and/or HIPAA information is processed by the system, they must be encrypted both when a rest
and in transit.
All internally and externally hosted websites and/or web-based applications should utilize TLS v1.1 or
higher encryption. TLS v 1.2 is preferred.
Applications should have logging functionality which includes timestamps, usernames, actions, and
other detailed information to reproduce incidents.Jump to an indexed page (163 of 163)