Information Security Policies for Vendors

Links contained in the documents may go to our employee intranet page, which is not accessible to vendors. If you need any additional information, please contact your procurement or contracting contact.

All documents are in PDF format. 

• Acceptable use of information technology resources policy
• Access control policy
• Assigned security responsibility
• Bring your own device policy
• Change management policy
• Cloud and removable media policy
• Configuration management policy
• Criminal justice information handling policy
• Documentation 
• Encryption at rest policy
• HIPAA security policies and procedures
• Incident management priority 2-4
• Information technology acquisition policy
• Major incident (priority 1)
• Malware protection policy
• Mobile device policy
• Network security policy
• Patch management policy
• Privileged access policy
• Records management policy
• Secure data transmission
• Security incident management policy
• Sensitive electronic data protection policy
• Technology asset management policy
• Workforce security