Agmt17 Smart Utility Systems, Inc.

Browse Search

service issued from this proposal for any purpose other than fulfilling the service. 4.5. Storage. All data furnished pursuant to the Agreement shall be stored within the United States. Said data shall be stored in single tenant architecture and shall not be comingled with the data or information of Consultant's other customers. Consultant shall not allow its personnel or contractors to store City data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. Consultant shall permit its personnel and contractors to access City data remotely only as required to provide technical support. Consultant may provide technical user support on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited in this contract. Consultant shall perform an independent audit of its data centers at least annually at its expense, and provide a redacted version of the audit report to City upon request. Consultant may remove its proprietary information from the redacted version. A Service Organization Control (SOC) 2 audit report or approved equivalent sets the minimum level of a third -party audit. 4.6 Security Incident or Data Breach Notification: The Consultant shall inform the City of any security incident or data breach. a. Incident Response: The Consultant may need to communicate with outside parties regarding a security incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the contract. Discussing security incidents with the City should be handled on an urgent as -needed basis, as part of Consultant communication and mitigation processes as mutually agreed upon, defined by law or contained in the contract. b. Security Incident Reporting Requirements: The Consultant shall report a security incident to the appropriate City identified contact immediately as defined in the SLA. c. Breach Reporting Requirements: If the Consultant has actual knowledge of a confirmed data breach that affects the security of any City content that is subject to applicable data breach notification law, the Consultant shall (1) promptly notify the appropriate City identified contact within 24 hours or sooner, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the data breach in a timely manner. 4.7 Breach Responsibilities: This section only applies when a data breach occurs with respect to personal data within the possession or control of the Consultant. a. The Consultant, unless stipulated otherwise, shall immediately notify the appropriate City identified contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a security incident. b. The Consultant, unless stipulated otherwise, shall promptly notify the appropriate City identified contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it confirms that there is, or reasonably believes that there Page 29 of 38 ATTY/AGR/2017.104/SMART ENERGY SYSTEMS—CUSTOMER WATER USE PORTAL REV: 05-15-17 MI