Law / United States / 
Connecticut
Requirements for state contractors who receive confidential information, data-security program and storage and copying prohibitions
Conn. Gen. Stat. sec. 4e-70(b) and (c)
In force since .
A sector security regimes rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security
As of .
What it requires
- This binds a contractor, an individual, business or other entity that receives confidential information from a state agency under a written agreement to provide goods or services to the state. The statute requires each such written agreement to carry the duties below, and the prohibitions in subsection (c) bind the contractor directly.
- Protect any confidential information you come to possess or control from a confidential information breach, at your own expense, wherever and however it is stored or maintained.
- Implement and maintain a comprehensive data-security program for the protection of confidential information, consistent with the safeguards in all applicable federal and state law and the state's written policies contained in the agreement.
- Include in that program a security policy for contractor employees on the storage, access and transportation of data containing confidential information, reasonable restrictions on access to records containing it (including secure passwords for electronically stored records), a review of policies and security measures at least annually, and an active and ongoing employee security awareness program that is mandatory for all employees who may have access to the information.
- Limit access to confidential information to authorized contractor employees and authorized agents, for authorized purposes necessary to complete the contracted services or provide the contracted goods.
- Maintain all electronic data constituting confidential information on a secure server and secure drives, behind firewall protections monitored by intrusion detection software, in a manner where access is restricted to authorized employees and their authorized agents.
- Implement, maintain and update security and breach investigation procedures that are appropriate given the nature of the information disclosed and reasonably designed to protect it from unauthorized access, use, modification, disclosure, manipulation or destruction.
- Do not store confidential information on stand-alone computer or notebook hard disks or portable storage devices such as external or removable hard drives, flash cards, flash drives, compact disks or digital video disks, except as the agreement provides, including alternate measures of security assurance approved under Section 4e-71 of the Connecticut General Statutes.
- Do not copy, reproduce or transmit confidential information except as necessary to complete the contracted services or provide the contracted goods; all copies and any modifications or additions that contain confidential information are subject to the same requirements as the original data.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Attorney General may investigate any violation of the section and bring a civil action in the superior court for the judicial district of Hartford, in the name of the state, against a contractor that has violated it (subsection (g)).
What this law does
Every written agreement that authorizes a state contracting agency to share confidential information with a contractor must require the contractor to meet the minimum requirements of Section 4e-70(b). One of those requirements is to implement and maintain a comprehensive data-security program for the protection of confidential information.
A contractor must not store data constituting confidential information on stand-alone computer or notebook hard disks or portable storage devices such as external or removable hard drives, flash cards, flash drives, compact disks or digital video disks, except as provided for in the agreement. A contractor must not copy, reproduce or transmit data constituting confidential information, except as necessary for the completion of the contracted services or provision of the contracted goods.
The Attorney General may bring a civil action in the superior court for the judicial district of Hartford, in the name of the state, against a contractor that has violated the section. The section took effect on .