Spreadsheet: 3a048192-370b-460a-b3d5-5c7d18f15fad
Sheet: 6. Data Security & Access

 | Functional Requirements
 | All of the following functionality is in the Thinkgate base system or on their development roadmap to be completed by 7/15/2013. |  | LEA Selected IIS
 | Requirement Description | Mandatory or Preferred | Meets Requirement (Y/N)? | Tool Name | Level of Satisfaction (1, 2 or 3) | Comments
6.0 | Data Security and Access
6.1  Data Security and Access
Thinkgate Narrative: | The Elements™ [NAME] was designed based on industry best practices related to information technology security. The Elements™ [NAME] includes an integrated user authentication component. This component includes industry standard features required for a robust user authentication system, including: • UserID, Password prompt at login • SSL encryption on login interactions • User selected password • Forced user selection of a password on first login • Timeout of session, requiring reentry of password to reactivate • Automatic access revoke after three incorrect password attempts • Admin ability to reset password • Passwords are not stored in clear text • Passwords are not displayed in clear text during login • Admin ability to revoke access • User profiles to allow job duties to be separated • All user ID creation, deletion, and change activity is logged  In addition to the integrated user authentication component, the Elements Platform includes the ability to interface with a federation based authentication system. The interface is created via a SAML based protocol using a [NAME] implementation. This authentication interface can be customized to support various authentication systems. Access to The Elements Platform by Thinkgate support personnel is done through a secure tunnel Virtual Private Network (VPN) which provides encryption and secure authentication.
6.1.1 | Provides secure, role-based access for multiple types of users such as district level administrators, school level administrators, teachers, students, parents, and the state as defined in state specific documentation | Mandatory
6.1.2 | Maintains controlled access to physical systems | Mandatory
6.1.3 | Provides end-to-end encryption and highly secure access via the World Wide Web | Preferred
6.1.4 | Ensures that system-specific security is managed in the database (not hard-coded), i.e., based on security profiles and levels which are maintained in security database tables and used for validation | Preferred
6.1.5 | Ensures secure, role-based access to confidential student data.  Login required at startup and access levels at all sub applications.  Access levels will include none, view, add, modify, and delete. | Mandatory
6.1.6 | Provides the ability for administrator to add, delete, and manage accounts | Mandatory
6.1.7 | All passwords should follow best practices guidelines, such as a minimum length and combination of alpha and numeric characters | Mandatory
6.1.8 | Provides a method for users to change their own password within established best practices guidelines | Mandatory
6.1.9 | Provides a method for users to retrieve their password or reset their password via automated email. | Preferred
6.1.10 | Provides a method for district system administrators to reset passwords but not view a user password | Preferred
6.1.11 | Ensures that passwords automatically expire | Preferred
6.1.12 | Enables security to be defined at the data element level; minimum level of  field access security are: no access, view access, add/update access, ability to delete data. | Preferred
6.1.14 | Provides full and incremental backup and restore | Mandatory
6.1.16 | Employs data validation for input forms. | Preferred
6.1.17 | Provides audit trail capability for all transactions such as: audit report of all database file changes, transaction details. (before and after) | Preferred
6.1.18 | Requires users to accept Terms of Service upon account creation and initial use of the system that license all materials uploaded or created into a Creative Commons CC-By-30 license, and provides assurance of legal rights to do so by user. Terms of Service agreement language will be a publicly hosted page within system. Database will track all users and their agreement to Terms of Service, including revision level of their agreement, as Terms of Service may be revised periodically and users will have to re-agree to the new terms. | Preferred
6.1.19 | Creative Commons: CC-By-30 license should be used for both the resource and the associated metadata, by default. Other license terms may be specified and any license terms must be tracked within database. | Preferred
OH.6.1.1 | Allows secure, role-based access for multiple types of users including, but not limited to administrators, teachers, students, and parents | Mandatory
OH.6.2.2 | Permits all fields that are edited to be audited to a log showing previous entry, time/date of change, and who made the change.  The log can only be accessed through a secure login. | Preferred