10. EXHIBIT X - INFORMATION SECURITY AND PRIVACY REQUIREMENTS.pdf

This exhibit outlines information security and privacy requirements applicable to the Decision Lens Licenses Renewal contract with the State of California. The document establishes mandatory security standards, data protection protocols, and compliance frameworks that the vendor must implement and maintain throughout the contract term. Requirements address confidentiality, integrity, and availability of information systems, along with specific controls for handling sensitive and personally identifiable information (PII). The vendor must comply with applicable federal and state privacy laws, including the California Consumer Privacy Act (CCPA) and other relevant data protection regulations. Security requirements encompass access controls, encryption standards, audit logging, vulnerability management, incident response procedures, and regular security assessments. The vendor is obligated to maintain documentation of security controls, undergo periodic compliance audits, and notify the state of any security breaches or incidents affecting systems and data.

The exhibit specifies that vendors must implement security measures appropriate to the sensitivity level of data handled and demonstrate compliance through certifications, attestations, or third-party assessments as required by the State of California. Vendors are required to maintain cybersecurity insurance and establish incident response and notification procedures. The requirements apply to all systems, personnel, and contractors involved in delivering the Decision Lens licenses and related services. Vendors must also establish business continuity and disaster recovery plans to ensure service availability. Non-compliance with information security and privacy requirements may result in contract termination, penalties, and liability for damages resulting from security failures or data breaches.