20-Exhibit X -Security Requirements Data Protection Clause (3).pdf

Exhibit ____ - City of Dallas Security Requirements

EXHIBIT ____

CITY OF DALLAS SECURITY REQUIREMENTS

Data Protection Requirements:

City Data and Intellectual Property. All right, title, and interest in City Data (as defined herein) will remain the property of City. Contractor has no intellectual property rights or other claim to City Data that is hosted, stored, or transferred to and from the hosted site or the cloud services platform provided by Contractor, or to City’s Confidential Information. Contractor will cooperate with City to protect City’s intellectual property rights and City Data. Contractor will promptly notify City if Contractor becomes aware of any potential infringement of those rights in accordance with the provisions of this Exhibit.

Security and Data Protection

1. City Data and Security. All City Data handled by Contractor under this Contract must be securely maintained and located Contractor’s or City of Dallas’s computing infrastructure Data Center(s). For purposes of this Contract and the Exhibits attached hereto “City Data” shall include any City Confidential and Regulated Information, and any personally identifiable information (PII) relating to any City’s end users or employees of City, its suppliers or Contractors (“Personal Data”), to which Contractor has or may have access in connection with the operation or administration of Contractor’s platform, or in connection with the performance of Professional Services by Contractor for City under the Contract or any applicable Statement(s) of Work. All City Data stored or at rest encrypted in the Data Centers, or in transport, will be encrypted in transport and will not be transferred to any other hosting entity or location without the prior written consent of City.

Contractor will provide the following available services and functions as part of the Software without additional cost to the City:

(i) the use of encryption technology to protect City Data from unauthorized access; and

(ii) routine back‐up and archiving of City Data. Contractor will comply with the requirements for Data Security set forth below and implement the Data Safeguards set forth in this Exhibit, and Contractor will further implement reasonable security standards that it determines are necessary, but in no event less than industry standards, to protect

(a) the physical security of the Data Centers used to maintain City Data; and (b) Contractor’s network, all operating systems and software applications, and all data storage systems and media provided by Contractor or its licensors or Contractors or operated or provided by City that connect or interface with Contractor’s Products, Software, or platform, from being subject to any Disabling Devices.

2. Data Safeguards. Contractor has represented to City that Contractor will not be permitted to access City Data stored or contained in the Products or Contractor’s platform, and Contractor will have no ability to manipulate, modify or control such City Data. If any support services or

Professional Services provided by Contractor may involve Contractor or its personnel having or requiring access to City servers, City applications, and/or City Data, Contractor shall comply with the provisions of this Section and the Data Security Requirements set forth below and, at City’s request, Contractor shall enter into an appropriate separate agreement with City to govern such access and protect any City Data that may be subject to such access. To the extent City grants Contractor access to City Data, or Contractor has access to or stores or holds any City Data, Contractor agrees to:

(i) access and use the City Data solely for the purpose of providing City with access to the Products, Software and Contractor’s platform, and to provide Professional Services to City in accordance with the terms and conditions of this Contract and any applicable Statement(s) of Work;

(ii) maintain physical, technical, and administrative safeguards (including but not limited to those set forth in the Data Security Requirements set forth below, and in any event no less than industry standards in the cloud computing/online services industry) to protect the City Data against unauthorized access, use, or disclosure while it is accessible to or held by Contractor (“Data Safeguards”); and

(iii) not disclose the City Data to any third party, except: (x) to its employees, consultants or Contractors who need to have access to such information and solely for purposes of providing.

Professional Services to City, provided that such recipients are bound by confidentiality provisions no less restrictive than those set out in this Contract; and (y) to the extent required by a judicial order or other legal obligation, provided that, to the fullest extent permitted by law, Contractor will promptly notify City of such a required disclosure to allow intervention by City (and will cooperate with City) to contest or minimize the scope of the disclosure.

3. Data Breach. Contractor further agrees that it will monitor and test its Data Safeguards from time to time, and further agrees to adjust its Data Safeguards from time to time considering relevant circumstances or the results of any relevant testing or monitoring. If Contractor suspects or becomes aware of any unauthorized access to any City Data or Personal Data by any unauthorized person or third party, or becomes aware of any other security breach relating to Personal Data held or stored by Contractor under this Contract or in connection with the performance of the Professional Services or other services performed under this Contract or any Statement(s) of Work (“Data Breach”), Contractor shall immediately notify City in writing and shall fully cooperate with City at Contractor’s expense to prevent or stop such Data Breach. In the event of such Data Breach, Contractor shall fully and immediately comply with applicable laws, and shall take the appropriate steps to remedy such Data Breach. Contractor will defend, indemnify, and hold City, its Affiliates, and their respective officers, directors, employees, and agents, harmless from and against any and all claims, suits, causes of action, liability, loss, costs, and damages, including reasonable attorney fees, arising out of, or relating to any third-party claim arising from breach by Contractor of its obligations contained in this Section, except to the extent resulting from the acts or omissions of City. All Personal Data to which Contractor has access under this Contract, as between Contractor and City, will remain the property of City. City hereby consents to the use, processing and/or disclosure of Personal Data only for the purposes described herein and to the extent such use or processing is necessary for Contractor to carry out its duties and responsibilities under this Contract, any applicable Statement(s) of Work, or as required by law. Contractor will not transfer Personal Data to third parties other than through its underlying network provider to perform its obligations under this Contract. All Personal Data delivered to Contractor shall be stored in the United States or other jurisdictions approved by City in writing and shall not be transferred to any other countries or jurisdictions without the prior written consent of City.

Data Security Requirements

1. General Security Procedures

1.1 Without limiting Contractor’s obligation of confidentiality as further described in the Contract and herein, Contractor will be responsible for establishing and maintaining an information security program that is designed to:

(i) ensure the security and confidentiality of City Data; (ii) protect against any anticipated threats or hazards to the security or integrity of the City Data; (iii) protect against unauthorized access to or use of the City Data; (iv) ensure the proper disposal of City Data, as further defined herein; and

(v) ensure that all sub-contractors of Contractor, if any, comply with all the foregoing. Contractor will designate an individual to be responsible for the information security program. Such individual will respond to City inquiries regarding computer security and to be responsible for notifying City‐designated contact(s) if a breach or an incident occurs, as further described herein.

1.2 Contractor must conduct formal security awareness training, with a testing component, for all personnel and Contractors as soon as reasonably practicable after the time of hiring or prior to being appointed to work on City Data and annually recertified thereafter. Documentation of Security Awareness Training must be retained by Contractor, confirming that this training and subsequent annual recertification process have been completed, and certification of completion provided to the City upon request.

1.3 City will have the right to review Contractor’s information security program prior to the commencement of City’s entry of data into the Products or delivery to City of any Professional Services and from time to time during the Term of this Contract. During the Term of the Contract, from time to time with proper notice and Contractor approval, which will not be unreasonably withheld, City, at its own expense, will be entitled to perform, or to have performed, an on‐site audit of Contractor’s information security program and facilities. In lieu of an on‐site audit, upon request by City, Contractor will use reasonable efforts to complete, within forty‐five (45 days) of receipt, an Information Security and Privacy Assessment questionnaire provided by City regarding Contractor’s information security and privacy program.

1.4 In the event of any actual or apparent theft, unauthorized use or disclosure of any City Data, Contractor will immediately commence all reasonable efforts to investigate and correct the causes and remediate the results thereof, and within two (2) business days following discovery of any such event, provide City notice thereof, and such further information and assistance as may be reasonably requested.

1.5 City Data, including but not limited to sales data, hosted, stored, or held by Contractor in the Product(s) or in the platform operated by Contractor, or on any device owned or in the custody of Contractor, its employees, agents, or Contractors, will be encrypted. Contractor will not transmit any unencrypted City Data over the internet or a wireless network and will not store any City Data on any mobile computing device, such as a laptop computer, USB drive or portable data device, except where there is a business necessity and then only if the mobile computing device is protected by industry‐standard encryption software approved by City.

1.6 The parties acknowledge and agree that any disclosure of City Data will in no way be construed to be an assignment, transfer, or conveyance of title to or ownership rights in such City Data.

2. Network and Communications Security

2.1 All Contractor connectivity to City computing systems and all attempts at same will be only through City’s security gateways/firewalls and only through City‐approved security procedures in compliance with City AD 2-24 and City of Dallas Information Security Standards.

2.2 Contractor will not access and will not permit unauthorized persons or entities to access, City computing systems and/or networks without City’s express written authorization, and any such actual or attempted access will be consistent with any such authorization.

2.3 Contractor will take appropriate measures to ensure that Contractor’s systems connecting to City’s systems and anything provided to City through such systems do not contain any Disabling Device. For purposes of this Contract , “Disabling Device” means any programs, mechanisms, programming devices, malware or other computer code (i) designed to disrupt, disable, harm, or otherwise impede in any manner the operation of any software program or code, or any computer system or network (commonly referred to as “ransomware”, “malware”, “spyware”, “viruses” or “worms”); (ii) that would disable or impair the operation thereof or of any software, computer system or network in any way based on the elapsing of a period of time or the advancement to a particular date or other numeral (referred to as “time bombs”, “time locks”, or “drop dead” devices); (iii) is designed to or could reasonably be used to permit a party or any third party to access any computer system or network (referred to as “trojans”, “traps”, “access codes” or “trap door” devices); or (iv) is designed to or could reasonably be used to permit a party or any third party to track, monitor or otherwise report the operation and use of any software program or any computer system or network by the other party or any of its customers.

3. City Data Handling Procedures

Erasure of Information and Destruction of Electronic Storage Media. If City Data is required to be permanently deleted from any storage media owned or operated by Contractor, all electronic storage media containing City Data must be wiped or degaussed for physical destruction or disposal, in a manner meeting forensic industry standards such as the NIST SP800‐88 Guidelines for Media Sanitization. Contractor must maintain documented evidence of data erasure and destruction. This evidence must be available for review at the request of City.

4. Data Protection. Contractor acknowledges that it may have access to certain of City’s computer and communications systems and networks for the purposes set forth in this Contract. If any data is made available or accessible to Contractor, its employees, agents, or Contractors, pertaining to City’s business or financial affairs, or to City’s projects, transactions, clients or customers, Contractor will not store, copy, analyze, monitor, or otherwise use that data except for the purposes set forth in the License Contract for the benefit of City.

Contractor will comply fully with all applicable laws, regulations, and government orders relating to personally identifiable information (“PII”), Sensitive Personal Information (SPI), and data privacy with respect to any such data that Contractor receives or has access to under the License Contract or in connection with the performance of any services for City. Contractor will otherwise protect PII and will not use, disclose, or transfer across borders such PII except as necessary to perform under the Contract or as authorized by the data subject or in accordance with applicable law. To the extent that Contractor receives PII related to the performance of the License Contract, Contractor will protect the privacy and legal rights of City’s personnel, clients, customers, and Contractors.

5. Physical Security

All backup and archival media containing City Data must be contained in secure, environmentally controlled storage areas owned, operated, or contracted for by Contractor and all backup and archival media containing City Data must be encrypted.

6. Penetration Testing

If any City data is stored with the Contractor, the Contractor will provide City with an annual, third- party Penetration Test report. During the term of this Contract, Contractor will engage, at its own expense and at least one time per year, a third-party Contractor reasonably acceptable to City to perform penetration and vulnerability testing (“Penetration Tests”) with respect to Contractor’s systems. The objective of such Penetration Tests is to identify design and/or functionality issues in infrastructure of Contractor’s systems that could expose City Data and its computer and network equipment and systems to risks from malicious activities. Penetration Tests will probe for weaknesses in network perimeters or other infrastructure elements as well as weaknesses in process or technical countermeasures relating to Contractor’s systems that could be exploited by a malicious party. Penetration Tests will identify, at a minimum, the following security vulnerabilities: invalidated or unsanitized input; broken access control; broken authentication and session management; cross‐site scripting (XSS) flaws; buffer overflows; injection flaws; improper error handling; insecure storage; denial of service; insecure configuration management; proper use of SSL/TLS; proper use of encryption; and anti‐virus reliability and testing. Within a reasonable period after the annual Penetration Test has been performed, City may request from Contractor a report of any high level and medium level security issues that were revealed during such Penetration Test and subsequent certification in writing to City that such high level and medium level security issues have been fully remediated. To the extent that high level and/or medium level security issues were revealed during a Penetration Test, Contractor will subsequently engage, at its own expense, the Testing City to perform an additional Penetration Test within a reasonable period thereafter to ensure continued resolution of identified security issues and will notify City with the results thereof.

City of Dallas Data and information shall be divided into the following classifications:

Public: Data or information classified as Public, (not explicitly and authoritatively classified as confidential) may be made generally available without specific Data Owner approval.

Sensitive: Data or information subject to public release under an open records request, but the information should be vetted and verified before release. These types of data include items such as employee records and gross salary information. Information that is still considered “public” but afforded a higher level of protection to ensure confidential data (e.g., net salary information) is not comingled.

Confidential: Data or information classified as Confidential shall be protected in a more secure manner than data or information classified as Public. that is typically excepted from public disclosure, whether specified in law or through a decision by the Open Records division of the Texas Attorney General’s office. The loss, corruption, or unauthorized disclosure of such data may be a violation of Texas Statues and/or Federal mandates, laws, and regulations.

Regulated: Data or information focused on the types of data typically regulated by state federal statute or third-party agreements. The loss, corruption, or unauthorized disclosure of such data may be a violation of Texas Statutes, Federal mandates, laws, and/or third-party agreements.

Hosted: Hosted services are applications, IT infrastructure components or functions that organizations access from external service providers, typically through a connection. A hosted service is defined as computer, including a centralized mainframe that is a host to its terminals, a server that is host to its clients, or a desktop personal computer (PC) that is host to its peripherals.

In network architectures, a client station (user’s machine) is also considered a host because it is a source of information to the network, in contrast to a device, such as a router or switch, that directs traffic.