Agmt25 Populus Technologies, Inc.

Browse Search

REV: 01-13-25 LR (iii) “Security Incident” means the potentially unauthorized access by non-authorized persons to City Date that Provider believes could reasonably result in the use, disclosure or theft of City Data within the possession or control of Provider. A Security Incident may or may not turn into a Data Breach. b. The Software and Services will be provided in accordance with the security protocols that are set forth in the security policy of Provider, which is attached hereto as Exhibit “H” (“Security Policy”). The Security Policy sets forth the minimum level of encryption, intrusion detection and data protection that is provided for the SaaS Solution and Provider will not make any change to the Security Policy during the terms of this Agreement that would provide less rigorous protection. Notwithstanding any term of the Security Policy, all City Data will be encrypted while in transit and while at rest or in storage on Provider’s servers. All connections between City and Provider where Provider employees or contractors have access to the City’s network or City Data while providing Services will be secured using a virtual private network or similar protocol. City Data that is stored by Provider will only be stored on servers, which are located in the United States of America. Provider shall not allow its personnel or contractors to store City Data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. Provider shall permit its personnel and contractors to access City Data remotely only as required to provide the Services or to provide technical support. c. Provider shall inform the City of any Security Incident or Data Breach in accordance with the following protocols: (i) Provider may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in this Agreement. Discussing Security Incidents with the City should be handled on an urgent as-needed basis, as part of Provider communication and mitigation processes as mutually agreed upon, defined by law or contained in this Agreement. (ii) Provider shall report a Security Incident to the appropriate City Identified Contact immediately. (iii) If Provider has actual knowledge of a confirmed Data Breach that affects the security of any City Data, Provider shall (1) promptly notify the appropriate City Identified Contact within 24 hours or sooner, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the Data Breach in a timely manner. (iv) Provider shall (1) cooperate with the City as reasonably requested by the City to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the Services, if necessary. (v) Unless otherwise stipulated, if a Data Breach is a direct result of Provider’s breach of its contractual obligation to secure City Data in accordance with this ATTY/AGR.2025.005/Populus Technologies, INC (SaaS Agreement) (Page 5 of 34)