Agmt18 Raycom Data Technologies Inc.

Browse Search

17.3 Data Location. Consultant shall provide its Services to the City and its end users solely from data centers in the U .S. Storage of City Data at rest shall be located solely in data centers in the U.S. Consultant shall not allow its personnel to store City Data on portable devices, including personal computers, except for devices that are used and kept only at its U .S . data centers. 17.4 Security Incident or Data Breach Notification. Consultant shall inform the City of any Security Incident or Data Breach: i. Incident Response: Consultant may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in this Agreement. Discussing Security Incidents with the City should be handled on an urgent as-needed basis, as part of communication and mitigation processes as mutually agreed upon, defined by law or contained in this Agreement. ii. Security Incident Reporting Requirements: Consultant shall report a Security Incident to the appropriate City Identified Contact immediately. iii . Breach Reporting Requirements: If Consultant has actual knowledge of a confirmed Data Breach that affects the security of any City content that is subject to applicable Data Breach notification law, Consultant shall (1 ) promptly notify the appropriate City staff Identified Contact within 24 hours or sooner, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the Data Breach in a timely manner. 17.5 Breach Responsibilities. This section only applies when a Data Breach occurs with respect to Personal Data or Non-Public Data within the possession or control of Consultant. i. Consultant, unless stipulated otherwise, shall immediately notify the appropriate City Identified Contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a Security Incident. ii. Consultant, unless stipulated otherwise, shall promptly notify the appropriate City Identified Contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it confirms that there is, or reasonably believes that there has been a Data Breach. Consultant shall (1 ) cooperate with the City as reasonably requested by the City to investigate and resolve the Data Breach , (2) promptly implement necessary remedial REV: 06-19-18 PR Page 7 of 23 ATTY/AGR.2018. 132/Raycom Data Technologies, Inc.