Agmt21 Cleverciti Systems, Corp.

Browse Search

16.4.2 All data obtained by Contractor in the performance of this Agreement shall become and remain property of the City. 16.4.3 At no time shall any City Data or processes - that either belong to or are intended for the use of the City or its officers, agents or employees - be copied, disclosed, sold, or retained by Contractor or any party related to Contractor for subsequent use in any transaction that does not include the City without the City's express written consent. 16.4.4 Contractor shall not use City Data for any purpose other than fulfilling the service without the City's express written consent. 16.5 Data Location. Contractor shall provide its services to the City solely from data centers in the United States. Storage of City data and Solution Data at rest shall be located solely in data centers in the U.S. Contractor shall permit its personnel and subcontractors to access City Data remotely only as required to provide the Services or offer technical support or other support specifically requested by the City. 16.6 Security Incident or Data Breach Notification. Contractor shall inform the City within 24 hours or sooner, unless shorter time is required by applicable law, of any Security Incident or Data Breach, cooperate with the City in addressing the matter, promptly implement measures to cure the breach, and implement breach notification and reconciliation protocols in accordance with NIST -approved methods. 16.6.1 Incident Response. Contractor may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries, and seeking external expertise as mutually agreed upon, defined by law, or contained in this Agreement. Discussing Security Incidents with the City should be handled on an urgent as -needed basis, as part of communication and mitigation processes as mutually agreed upon, defined by law, or contained in this Agreement. 16.6.2 Security Incident Reporting Requirements. Contractor shall report a Security Incident to the appropriate City staff immediately. 16.6.3 Breach Reporting Requirements. If Contractor has actual knowledge of a confirmed Data Breach that affects the security of any City content that is subject to applicable Data Breach notification law, Contractor shall: (1) promptly notify the appropriate City staff within 24 hours or sooner, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the Data Breach in a timely manner. 16.6.4 Breach Responsibilities. If any forensic analysis or report determines Contractor to be the sole source of any Security Incident or Data Breach, the City will not be responsible for any data compromise losses or damages, and Contractor will hold harmless the City, its officers, officials, employees, and REV: 12-10-2020 SK ATTY/AGR.2020.282/Cleverciti (Parking Guidance System Project) (Page 12 of 54)