State of Wisconsin Division of Enterprise Technology (DET) Enterprise Encryption Service Offering Definition (SOD)

Transcription

1 State of Wisconsin Division of Enterprise Technology (DET) Enterprise Encryption Service Offering Definition (SOD) Enterprise Encryption /3/2010

2 Document Revision History (Major Post Publishing Revisions Only) Date Version Creator Notes 12/03/ Lisa Jorgensen Added modified How Services are Charged language Enterprise Encryption /3/2010

3 Table of Contents Introduction... 4 What Is Included... 4 What Is Not Included... 4 Benefits... 5 Service Description... 5 Service Period... 5 Roles and Responsibilities... 5 Performance Metrics (Monitoring/Alerting/Reporting)... 6 Configuration Diagram... 6 How Services Are Charged... 6 Cost-Saving Tips... 6 Notes:... 6 Enterprise Encryption /3/2010

4 Introduction The Division of Enterprise Technology (DET) Enterprise Encryption Service provides a security appliance platform to encrypt outgoing . Agencies can utilize the Encryption services to protect data that contains personal health information or privacy information which is sent via outside of the Enterprise system. Protection of electronic data complies with recommendations made in Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH). Once setup, the sender can initiate encryption through various means, including installing an client plug-in that allows them to encrypt a message with the click of a button, or s can be encrypted automatically through administrator-configured rules and policies. What Is Included The DET Enterprise Encryption Service includes: The ability to send encrypted to recipients external to the Enterprise E- mail System (or agency hosted system) by either Outlook Plug-in or automatically through administrator-configured policies Enterprise hosted policies for individual agencies, if so desired A single Enterprise library of terms Cisco Registered Envelope Services (CRES) Frequently Asked Questions (FAQ) document Administrator Guide Generic User Guide (this can be individualized for specific agency use by the agency) What Is Not Included Delegated administration of agency specific security policies (Creation of rules which trigger automatic encryption) (These policies can be requested through the normal service request process) End user training Support of client-side plug-in Creation of agency specific distribution list (DL). Enterprise Encryption /3/2010

5 Benefits Enterprise Encryption will satisfy compliance requirements for regulatory requirements and recommendations such as Payment Card Industry (PCI), HIPAA, and HITECH. Agencies that subscribe to this service will be able to ensure protected data is encrypted from the IronPort appliance to the receiving customers mailbox. Since the Encryption is integrated into the Cisco IronPort security appliances, this allows for a simpler encryption infrastructure and lower capital and operational costs to the subscribing agencies. Service Description The Division of Enterprise Technology (DET) Enterprise Encryption Service provides an opportunity for agencies to employ encryption to protect all privileged and private data in outgoing to external customers or business partners. This service will allow state agencies to comply with electronic data protection recommendations made in Health Insurance Portability and Accountability Act (HIPAA) and the subsequent Health Information Technology for Economic and Clinical Health Act (HITECH). PCI requirements also include securing the transmission of credit card holder data if sent over a public network. Once encryption has been configured for the licensed end users, the sender can initiate encryption through various means, including installing an client plug-in that allows them to encrypt a message with the click of a button or s can be encrypted automatically through administrator-configured policies. If agencies choose to allow their licensed end users to encrypt messages on demand through the Outlook plug-in, the agency desktop support staff will be responsible for installing and maintaining the plug-in software. If agencies choose to require their licensed end users to encrypt via administrator configured rules and policies, those policies need to be requested through the DET Service Request Process. Service Period July 1 through June 30 reviewed and renewed bi-annually. Roles and Responsibilities Roles and Responsibilities for the Encryption service can be found here. Enterprise Encryption /3/2010

6 Performance Metrics (Monitoring/Alerting/Reporting) Reporting Metrics for the Enterprise Service will be determined at a later date. Configuration Diagram How Services Are Charged Encryption is charged based on an agreed upon license count and purchase per customer and is billable on a once a year basis within the first quarter of the fiscal year. Any additional requested license purchases through the year will be billed immediately based on a prorated published rate to coincide with the fiscal year. The additionally purchased licenses will then be added to the agency count for consecutive year billing. Active customers will be asked for updated license count requirements each maintenance renew period and will be billed according to that new license count request, agreement and renewal. Please see the DOA IT Services Rate Sheet for rate information. Cost-Saving Tips Confirm that agency subscribers are actually using the Encryption Service. If not, reduce the agency license count accordingly. Notes: Enterprise Encryption /3/2010

7 Enterprise Encryption /3/2010