APPENDIX X

SUPPLEMENTAL DATA SECURITY PROVISIONS

FOR RFP #6100037836

Definitions

“Authorized Employees” – means Contractor’s employees who have a need to know or otherwise access Information to enable Contractor to perform its obligations under this Contract, and who are bound in writing by confidentiality obligations sufficient to protect the Information in accordance with the terms and conditions of this Contract.

“Information” – means an (i) individuals’s government-issued identification number (including Social Security Number, driver’s license number or state-issued identified number); (ii) financial account number, credit card number, debit card number, credit report information, with or without any required security code, access code, personal identification number or password, that would permit access to an individual’s financial account; or (iii) biometric or health data.

“Security Breach” – means the unauthorized access to and/or acquisition of computerized data that compromises the security, confidentiality or integrity of Information maintained in the Commonwealth’s and/or Contractor’s software, databases, computer networks or the physical, technical, administrative or organizational safeguards.

Standard of Care

(a)Contractor acknowledges and agrees that, in the course of its engagement by the Commonwealth, Contractor may receive or have access to Information. Contractor shall comply with the terms and conditions set forth in this Contract in its collection, receipt, transmission, storage, disposal, use and disclosure of Information and be responsible for the unauthorized collection, receipt, transmission, access, storage, disposal, use and disclosure of Information under its control or in its possession by all Authorized Employees.

(b)Information is deemed to be confidential information of the Commonwealth and is not confidential information of Contractor. In the event of a conflict or inconsistency between this Section and the Confidentiality sections of this Contract, the terms and conditions set forth in this Section shall govern.

Information Security

(a)Contractor represents and warrants that its collection, access, use, storage, disposal and disclosure of Information does and will comply with all applicable federal, state and privacy and data protection laws, as well as applicable regulations and directives.

(b)Contractor shall implement administrative, physical and technical safeguards to protect Information that are no less rigorous than accepted industry practices including - The International Organization for Standardization’s standards; ISO/IEC 27001:2005 – Information Security Management Systems – Requirements and ISO/IEC 27002:2005 – Code of Practice for International Security Management. [LJR1][BJ2][NT3]

(c)At a minimum, Contractor’s safeguards for the protection of Information shall include: (i) limiting access to Information to Authorized Employees; (ii) securing business facilities, data centers, paper files, servers, back-up systems and computing equipment, including, but not limited to all mobile devices and other equipment with information storage capability; (iii) implementing network, device application, database and platform security; (iv) securing information transmission, storage and disposal; (v) implementing authentication and access controls within media, applications, operating systems and equipment; (vi) encrypting Information stored on any mobile media; (vii) encrypting Information transmitted over public or wireless networks; (viii) segregating Information from information of Contractor or its other customers so that Information is not commingled with any other types of Information; (ix) implementing appropriate personnel security and integrity procedures and practices, including, but not limited to, conducting background checks consistent with applicable law; and (x) providing appropriate privacy and information security training to Contractor’s employees.

Security Breach Procedures

(a)Contractor shall:

(i)Provide the Commonwealth with the name and contact information for an employee of Contractor who will serve as the Commonwealth’s primary security contact and shall be available to assist the Commonwealth twenty-four (24) hours per day, seven (7) day per week as a contact in resolving obligations associated with a Security Breach;

(ii)Notify the Commonwealth of a Security Breach within one (1) hour of when the selected Contractor knew of such unauthorized access, use, release, or disclosure of dataas soon as practicable, but no later than twelve (12) hours [LJR4][BJ5][NT6]after Contractor becomes aware of it; and

(iii)Notify the Commonwealth of any Security Breach by: [TELEPHONE NUMBER]/e-mailing the Commonwealth with a read receipt at [E-MAIL ADDRESSES] and with a copy by e-mail to Contractor’s primary business contact with the Commonwealth. Upon award contact information will be provided to the Contractor by the Contract Manager in writing.

(b)The parties shall coordinate with each other to investigate the Security Breach. Contractor agrees to fully cooperate with the Commonwealth in the Commonwealth’s handling of the matter, including, without limitations: (i) assisting with any investigation; (ii) providing the Commonwealth physical access to the facilities and operations affected; (iii) facilitating interviews with Contractor’s employees and others involved in the matter; and (iv) making available all relevant records, logs, files, data reporting and other materials required to comply with applicable law, regulation, industry standards or as otherwise required by the Commonwealth.

(c)Contractor shall use best efforts to immediately remedy any Security Breach and to prevent any further Security Breach at Contractor’s expense in accordance with applicable privacy rights, laws, regulations and standards. Contractor shall reimburse the Commonwealth for costs incurred by the Commonwealth in responding to, and mitigating damages caused by, any Security Breach.

(d)Contractor agrees that it shall not inform any third party of any Security Breach without first obtaining the Commonwealth’s prior, written consent, other than to inform a complainant that the matter has been forwarded to the Commonwealth’s legal counsel. Further, Contractor agrees that the Commonwealth shall have the sole right to determine: (i) whether notice of the Security Breach is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies or others as required by law or regulation, or otherwise in the Commonwealth’s discretion; and (ii) the contents of such notice, whether any type or remediation may be offered to affected persons, and the nature and extent of any such remediation.

[LJR1]I pulled these from some publications that I have. Please revise these to include the practices that PSP finds acceptable.

[BJ2]Jamie and Toni will confirm if there is anything else that should be listed here.

[NT3]Nothing to add

[LJR4]You can put whatever time frame you would like here.

[BJ5]Toni, Jamie will confirm what to enter here. Reference ITP.

[NT6]Updated to align with language found in the non-commonwealth hosted application services template.