Agmt19 True Point Solutions - Laserfiche WebLink

Browse Search

Agreement for TruePoint Services City of Redwood City 6.2 Data Protection. Protection of personal privacy and data shall be an integral part of the business activities of Consultant to ensure there is no inappropriate or unauthorized use of Customer Data at any time. To this end, Consultant shall safeguard the confidentiality, integrity, and availability of Customer Data and comply with the following conditions: 6.2.1 Consultant shall implement and maintain appropriate administrative, technical and organizational security measures to safeguard against unauthorized access, disclosure or theft of Customer Data. Such security measures shall be in accordance with recognized industry practice and not less stringent than the measures Consultant applies to its own Customer Data of similar kind. 6.2.2 All data obtained by Consultant in the performance of this Agreement shall become and remain the property of the City. 6.2.3 All Customer Data shall be encrypted at rest and in transit with controlled access. Unless otherwise stipulated, Consultant is responsible for encryption of Customer Data. 6.2.4 For data at rest, Consultant shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Customer Data. 6.2.5 At no time shall any data or processes — that either belong to or are intended for the use of the City or its officers, agents or employees —be copied, disclosed or retained by Consultant or any party related to Consultant for subsequent use in any transaction that does not include the City. 6.2.6 Consultant shall not use any information collected in connection with the Services issued from this Agreement for any purpose other than fulfilling the Services. 6.3 Data Location. Consultant shall provide its Services to the City and its end users solely from data centers in the U.S. Storage of City Data at rest shall be located solely in data centers in the U.S. Consultant shall not allow its personnel to store City Data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. 6.4 Security Incident or Data Breach Notification. Consultant shall inform the City of any Security Incident or Data Breach: 6.4.1 Incident Response: Consultant may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in this Agreement. Discussing Security Incidents with the City should be handled on an urgent as -needed basis, as part of communication and mitigation processes as mutually agreed upon, defined by law or contained in this Agreement. 6.4.2 Security Incident Reporting Requirements: Consultant shall report a Security Incident to the Contract Officer immediately. 6.4.3 Breach Reporting Requirements: If Consultant has actual knowledge of a confirmed Data Breach that affects the security of any City content that is subject to applicable Data Breach notification law, Consultant shall (1) promptly notify the Contract Officer within 24 hours or sooner, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the Data Breach in a timely manner. REV: 04-23-19 PR Page 5 of 64 ATTY/AGR.2019.106/TruePoint TrueBill Utility Billing System