Agmt22 Axon Enterprises, Inc. - Laserfiche WebLink

Browse Search

and Non-Public Data. Any stipulation of responsibilities will identify specific roles and responsibilities and shall be included in a service level agreement signed by Vendor and City. 4.4.For data at rest, Vendor shall ensure hard drive encryption consistent with validated cryptography standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data. 4.5.At no time shall any data or processes — that either belong to or are intended for the use of City or its officers, agents or employees — be copied, disclosed or retained by Vendor or any party related to Vendor for subsequent use in any transaction that does not include the City. 4.6.Vendor shall not use any information collected in connection with the Services issued from this Purchase Agreement for any purpose other than fulfilling the Services. 4.7.Data Location. Vendor shall provide its Services to the City and its end users solely from data centers in the U.S. Storage of City Data at rest shall be located solely in data centers in the U.S. Vendor shall not allow its personnel or contractors to store City Data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. Vendor shall permit its personnel and contractors to access City Data remotely only as required to provide the Services or to provide technical support. Vendor may provide technical user support on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited in this Purchase Agreement. 5. Security Incident or Data Breach Notification. Vendor shall inform the City of any Security Incident or Data Breach: 5.1. Incident Response: Vendor may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in this Purchase Agreement. Discussing Security Incidents with the City should be handled on an urgent as- needed basis, as part of Vendor communication and mitigation processes as mutually agreed upon, defined by law or contained in this Purchase Agreement. 5.2. Security Incident Reporting Requirements: Vendor shall report a Security Incident to the appropriate City Identified Contact immediately. 5.3. Breach Reporting Requirements: If Vendor has actual knowledge of a confirmed Data Breach that affects the security of any City content that is subject to applicable Data Breach notification law, Vendor shall (1) promptly notify the appropriate City Identified Contact within 48 hours or sooner, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the Data Breach in a timely manner. ATTY/AGR.2022.299/Axon Enterprises, Inc. (RCPD Axon Fleet Cameras) (Page 13 of 32)