AgdaPkt 2017-06-12 Joint SA PFA - Laserfiche WebLink

Browse Search

Page 28 of 38 ATTY/AGR/2017.104/SMART ENERGY SYSTEMS – CUSTOMER WATER USE PORTAL REV: 05-15-17 MI limitation, derivative data and data combined with the data of other utilities, for purposes of project evaluation and any research, product development, marketing, or other legitimate business purposes. This Section 4.3 shall survive any termination or expiration of the Agreement. 4.4. PCI Compliance. Consultant warrants and represents that it is PCI-DSS SAQ-D compliant and that any data transmitted by the Software will be sent via industry-standard PCI-compliant means. Consultant shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all personal data, unless City approves the storage of personal data on a Consultant portable device in order to accomplish work as defined in the statement of work. (a) Data Protection: Protection of personal privacy and data shall be an integral part of the business activities of the Consultant to ensure there is no inappropriate or unauthorized use of City information at any time. To this end, the Consultant shall safeguard the confidentiality, integrity and availability of City information and comply with the following conditions: (i) The Consultant shall implement and maintain appropriate administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of personal data and non-public data. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures the Consultant applies to its own personal data and non-public data of similar kind. (ii) All data obtained by the Consultant in the performance of this contract shall become and remain the property of the City. (iii) All personal data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, the Consultant is responsible for encryption of the personal data. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in the service level agreement (SLA), or otherwise made a part of this contract. (iv) Unless otherwise stipulated, the Consultant shall encrypt all non-public data at rest and in transit. The City shall identify data it deems as non-public data to the Consultant. The level of protection and encryption for all non-public data shall be identified and made a part of this contract. (v) At no time shall any data or processes — that either belong to or are intended for the use of a City or its officers, agents or employees — be copied, disclosed or retained by the Consultant or any party related to the Consultant for subsequent use in any transaction that does not include the City. (vi) The Consultant shall not use any information collected in connection with the 6.1.E. - Page 31