22-Exhibit B - Business Continuity.pdf

Exhibit ____ – Business Continuity and Disaster Recovery Plan

EXHIBIT ____

BUSINESS CONTINUITY AND DISASTER RECOVERY PLAN

1. Hosted Services Solution

1.1 Contractor’s Hosted Services are audited at least yearly in accordance with the American Institute of Certified Public Accountants’ (AICPA) Statement on Standards for Attestation Engagements (“SSAE”) No. 18, as amended. Contractor has attained, and will maintain, SOC 1 and SOC 2 compliance, or its equivalent, for so long as the City is timely paying for Hosted Services. Upon execution of a mutually agreeable Non-Disclosure Agreement (“NDA”), Contractor will provide the City with a summary of its compliance report(s) or its equivalent. Every year thereafter, for so long as the NDA, Contractor will provide that same information on the NDA anniversary date.

1.2 The City will be hosted on shared hardware, within the United States, in a Contractor data center, but in a database dedicated to the City of Dallas, which is inaccessible to Contractor’s other customers.

1.3 Contractor data center will have fully redundant telecommunications access, electrical power, and the required hardware to provide access to the Contractor Software in the event of a disaster or component failure. In the event any of your data has been lost or damaged due to an act or omission of Contractor or its subcontractors or due to a defect in Contractor’s software, we will use best commercial efforts to restore all the data on servers in accordance with the architectural design’s capabilities and with the goal of minimizing any data loss as greatly as possible. In no case shall the recovery point objective (“RPO”) exceed a maximum of two (2) hours from declaration of disaster. For purposes of this subsection, RPO represents the maximum tolerable period during which your data may be lost, measured in relation to a disaster we declare, said declaration will not be unreasonably withheld.

1.4 In the event Contractor declares a disaster, Contractor’s Recovery Time Objective (“RTO”) is four (4) hours. For purposes of this subsection, RTO represents the amount of time, after Contractor declares a disaster, within which the City’s access to the Contractor Software must be restored.

1.5 Contractor conducts annual penetration testing of either the production network and/or web application to be performed. Contractor will maintain industry standard intrusion detection and prevention systems to monitor malicious activity in the network and to log and block any such activity. Contractor will provide the City with a written or electronic record of the actions taken by Contractor if any unauthorized access to the City’s database(s) is detected as a result of Contractor’s security protocols. Contractor will undertake an additional security audit, on terms and timing to be mutually agreed to by the parties, at the City’s written request. The City may not attempt to bypass or subvert security restrictions in the Hosted Services or environments related to the Contractor Software. Unauthorized attempts to access files, passwords or other confidential information, and unauthorized vulnerability and penetration test scanning of Contractor’s network and systems (hosted or

Exhibit ____ – Business Continuity and Disaster Recovery Plan otherwise) is prohibited without the prior written approval of Contractor’s IT Security Officer.

1.6 Contractor tests its disaster recovery plan on an annual basis. The standard test is not client specific. Should the City request a client-specific disaster recovery test, Contractor will work with the City to schedule and execute such a test on a mutually agreeable schedule.

1.7 Contractor will be responsible for importing back-up and verifying that the City can log-

in. The City will be responsible for running reports and testing critical processes to verify the returned Data. At the City’s written request, Contractor will provide test results to the City within a commercially reasonable timeframe after receipt of the request.

1.8 Notwithstanding the obligations set forth herein, the redundancies set forth in this Exhibit are not a substitute of the City performing and maintaining routing backups of its own Data until such time as the City’s data is hosted in the Contractor’s data center. Contractor shall have no liability to the City for the City’s sole failure to maintain its own backups of City Data.

1.9 Contractor provides secure Data transmission paths between each of the City’s workstations and Contractor’s servers, until such time as the City’s data is hosted in the Contractor’s data center.

1.10 For at least the past twelve (12) years, all of Contractor’s employees have undergone criminal background checks prior to hire. All employees sign Contractor’s confidentiality agreement and security policies, which will be as restrictive as the city’s terms.

Contractor’s data centers are accessible only by authorized personnel with a unique key entry. All other visitors must be signed in and accompanied by authorized personnel. Entry attempts to the data center are regularly audited by internal staff and external auditors to ensure no unauthorized access.

1.11 Where applicable with respect to Contractor’s applications that take or process card payment data, Contractor is responsible for the security of cardholder data that Contractor possesses, including functions relating to storing, processing, and transmitting of the cardholder data and affirm that, as of the Effective Date, Contractor complies with applicable requirements to be considered Payment Card Industry Data Security Standard (“PCI DSS”) compliant and have performed the necessary steps to validate compliance with the PCI DSS. Contractor agrees to supply the current status of its PCI DSS compliance program in the form of an official Attestation of Compliance, and in the event of any change in Contractor’s status, will comply with applicable notice requirements.

2. SLA Requirements

2.1 The applicable service levels shall be as set forth in a Service Level Agreement attached to this Contract, if applicable.

https://www.tylertech.com/about-us/compliance

Exhibit: B