3-4. Appendix A.02 - Data Privacy and Security Requirements.pdf

22397503.2

EXHIBIT C TO THE SAMPLE CONTRACT:

DATA PRIVACY, SECURITY AND CLOUD SOFTWARE REQUIREMENTS

1. DATA PRIVACY. The Contractor may have access to personally identifiable information

("PII") in connection with the performance of the Agreement. PII is any information that identifies or describes a person or can be directly linked to a specific individual. Examples of PII include, but are not limited to, name, address, phone number, signature, date of birth, e-mail address, method of payment, payment card information, ridership and travel pattern data.

MST Personally Identifiable Information, or MST PII, means any PII relating to MST's customers, contractors, subcontractors, consultants, subconsultants, directors, officers, employees, including permanent, temporary, and provisional employees, and agents, that is collected, owned, licensed, maintained, used or accessed by the Contractor in connection with this Agreement.

The Contractor must ensure and maintain the confidentiality, security, safety, and integrity of all MST PII, including physical, electronic, and procedural safeguards designed to prevent unauthorized access or use and protect against known or anticipated threats to the security or integrity of such data. This includes, but is not limited to, the secure transport, transmission and storage of MST PII used or acquired in the performance of this Agreement.

Notwithstanding the generality of the foregoing requirements, Contractor will adhere to the following requirements concerning MST PII:

A. The Contractor may not, except as authorized or required by law, reveal or divulge to any person or entity any MST PII that becomes known to it during the term of this Agreement. The Contractor may not use or attempt to use any such information in any manner that may injure or cause loss, either directly or indirectly, to MST.

B. The Contractor must maintain policies and programs that prohibit unauthorized disclosure of MST PII and promote training and awareness of information security policies and practices. The Contractor must comply, and must cause its employees, representatives, agents, and subcontractors to comply, with such commercially and operationally reasonable directions as MST may make to promote the safeguarding or confidentiality of MST PII.

C. The Contractor must conduct background checks for employees or subcontractors that have access to MST PII or host MST PII.

D. The Contractor must limit access to computers and networks that host MST PII, including without limitation through user credentials and strong passwords, data encryption both during transmission and at rest, firewall rules, and network-based intrusion detection systems.

E. The Contractor agrees to comply with the information handling and confidentiality requirements outlined in the California Information Practices Act (Civil Code sections 1798 et. seq.) and Civil Code Section 1798.81.5(b). In addition, the Contractor warrants and certifies that in the performance of this Agreement, it will comply with all applicable statutes, rules, regulations and orders of the United States, and the State of California relating to the handling and confidentiality of MST PII, including the terms and conditions contained in this Section.

This Section will survive termination or expiration of this Agreement.

2. DATA SECURITY. The Contractor must provide those administrative, physical, and technical safeguards for protection of the security, confidentiality, integrity, and availability of MST PII in alignment with industry standards (e.g., ISO 27001). In particular:

A. The Contractor agrees to properly secure and maintain any computer (hardware and software applications) or electronic media that it will use in the performance of this Agreement. This includes ensuring all security patches, upgrades, and anti-virus updates are applied to secure MST PII that may be used, transmitted, or stored on such software in the performance of this Agreement.

B. The Contractor, its employees, agents, Subcontractors, and Contractors may not download or otherwise store any MST PII onto any Contractor computer, desktop, laptop, thumbdrive, disk, or other portable memory device without such data being encrypted.

C. The Contractor represents that its hosting environment is built upon a secure infrastructure, which undergoes examinations from an independent auditor in accordance with the minimum standards of care recommended by the California Attorney General in her February, 2016 report (See https://oag.ca.gov/breachreport2016). For added security, the Contractor will use multi-factor authentication when accessing the infrastructure. In addition to the independent audit, MST will have the right at any time, upon reasonable notice, to audit and inspect: (i) Contractor's facilities where MST PII is stored or maintained; (ii) any computerized software used to share, disseminate or otherwise exchange MST PII; and (iii) Contractor's security practices and procedures, data protection, business continuity and recovery facilities, resources, plans and procedures related to software where MST PII is shared, disseminated or otherwise exchanged. The audit and inspection rights hereunder shall be for the purpose of verifying Contractor's compliance with this Agreement, and all applicable laws.

D. The Contractor must process and store all MST PII in a single-tenant environment and at no time will MST PII be commingled with data of independent third-party users of Contractor's services.

E. The Contractor must have vulnerability management programs to identify and minimize threats and risks on any software used to store or transmit MST PII.

F. The Contractor represents that the Contractor's management access to the hosting infrastructure is limited to authorized support staff. The security architecture has been designed to control appropriate logical access to the infrastructure to meet industry standards that meet or exceed the Trust Services Criteria and Principles for Security, Availability, Integrity, and Confidentiality established by the AICPA.

G. Notwithstanding anything to the contrary in this Agreement, the Contractor agrees to retain MST PII for no longer than three days after the completion date of this Agreement and MST's confirmation that the Contractor may proceed with such deletion. At the conclusion of this retention period, the Contractor agrees to use U.S.

Department of Defense ("DoD") –approved method and removal of MST PII from any files, with said service being included in the total cost of this Agreement. Discarded MST PII will be unavailable and unrecoverable following the purge on any storage media including, but not limited to, magnetic disk, optical disk, and memory chips ("Storage Media"). The Contractor agrees to destroy hard-copy documents containing MST PII by means of a cross-cut shredding machine. The Contractor also agrees to use DoD—approved methods, or an alternate Client-approved method, to sanitize any Storage Media prior to discarding or when useful life has ended, whichever comes first. At the conclusion of the performance period of this Agreement, the Contractor shall submit a certification to MST's Project Manager that all electronic or hard-copy format MST PII has been destroyed in accordance with the Agreement.

H. The Contractor is responsible for the security of the cardholder data the service providers possess or otherwise store, process or transmit on behalf of MST's customers, and to the extent that it could impact the security of the customer's cardholder data environment. The Contractor must at all times remain in compliance with the Payment Card Industry (PCI) Data Security Standard (DSS) requirements, including remaining aware at all times of changes to the PCI DSS and promptly implementing all procedures and practices as may be necessary to remain in compliance with PCI DSS, in each case, at the Contractor's sole cost and expense.

I. This Section will survive termination or expiration of this Agreement.

3. NOTICE OF SECURITY BREACH. The Contractor must immediately notify MST when it discovers that there may have been a data security incident that has or may have resulted in compromise to MST PII. For purposes of this Section, immediately is defined as within twenty-four hours of discovery. The Contractor must immediately take such actions as may be necessary to preserve forensic evidence and eliminate the cause of any suspected breach or security vulnerability—and must promptly alert MST of any such circumstances, including information sufficient for MST to assess the nature and scope of any suspected data breach.

In the event of an unauthorized disclosure of MST PII, the Contractor will be liable for paying for the following costs to remediate any such unauthorized disclosure:

A. The reasonable cost of providing notice of the breach to individuals affected by such breach;

B. The reasonable cost of providing required notice of the breach to government agencies, credit bureaus, and/or other required entities;

C. The cost of providing individuals affected by such breach with credit protection services designed to prevent fraud associated with identity theft crimes for a specific period not to exceed 12 months; and

D. Any other service required by applicable law.

The Contractor must provide any information and/or support to MST in issuing the actual notification and, at MST's sole discretion, the Contractor must itself provide actual notification if MST desires. This Section will survive termination or expiration of this Agreement.

4. SERVICE LEVEL AGREEMENT. The following additional requirements apply the software solution:

A. Application Availability. Contractor must provide 99.99% application availability and maintain logs establishing uptime and downtime for the duration of the

Contract. Actual Application Availability % = (Monthly Minutes (MM) minus Total Minutes Not Available (TM)) multiplied by 100) and divided by Monthly Minutes (MM), but not including Excluded Events.

B. Service Credit Calculation. An Outage will be deemed to commence when the Applications are unavailable to MST and end when Contractor has restored availability of the services. Failure to meet the 99.99% Application Availability, other than for reasons due to an Excluded Event, will entitle MST to a credit as follows:

Actual Application Availability % (as measured in a calendar month)

Service Credit to be applied to MST's monthly invoice for the affected month

<99.99% to 99.9% 10%

<99.9% to 99.75% 15%

<99.75% to 98.75% 25%

<98.75 to 97.75% 35%

<97.75% 50%

"Outage" means the accumulated time, measured in minutes, during which MST is unable to access the Applications for reasons other than an Excluded Event.

“Excluded Event” means any event that results in an Outage and is caused by (a) the acts or omissions of MST, its employees, customers, contractors or agents; (b) the failure or malfunction of equipment, applications or systems not owned or controlled by Contractor or its subcontractors; (c) Force Majeure events, excluding acts resulting in a breach of Confidential Information or Personally Identifiable Information; (d) scheduled or emergency maintenance, alteration or implementation provided during the Maintenance Period defined below; (e) any suspension of the services in accordance with the terms of the Contract; (f) the unavailability of required MST personnel, including as a result of failure to provide Contractor with accurate, current contact information; or (g) using an Application in a manner inconsistent with the product documentation for such Application.

“Maintenance Period” means scheduled maintenance periods mutually agreed upon by MST and Contractor to maintain and update the services, when necessary. During these Maintenance Periods, the Services are available to Contractor to perform periodic maintenance services, which include vital software updates. Contractor will use its commercially reasonable efforts during the Maintenance Period to make the services available to MST; however, some changes will require downtime. Contractor will provide notice for planned downtime via an email notice to the primary MST contact at least one day in advance of any known downtime so planning can be facilitated by MST.

“Monthly Minutes (MM)” means the total time, measured in minutes, of a calendar month commencing at 12:00 am of the first day of such calendar month and ending at 11:59 pm of the last day of such calendar month.

“Total Minutes Not Available (TM)” means the total number of minutes during the calendar month that the services are unavailable as the result of an Outage.

5. TRANSITION. Upon the termination or expiration of this Agreement, the Contractor must cooperate fully with MST, and any successor contractor to provide to MST, and any successor contractor, electronic copies of all branding materials, logos, reports, designs, drawings, plans, specifications, schedules, information, payment history, payment records, and other materials prepared, or in the process of being prepared for the services to be performed by Contractor (Work Product) to ensure a smooth transition to a new software solution. All MST PII must be protected, kept secure, and transmitted securely at all times in accordance with the terms of this Agreement. All Work Product must be provided in a format that is usable by the successor contractor, such as latest version of Microsoft WORD and/or EXCEL.

If MST terminates the Agreement, the Contractor must begin preparing all Work Product to allow for a smooth transition to a successor Contractor or to permit MST to operate a similar software solution in the future. Within 30 calendar days of MST's termination of the Agreement, the Contractor must transfer all other Work Product, including written reports, data, and other relevant information, to MST and the successor Contractor. MST will withhold payment of Contractor's final invoice until Contractor has ensured a smooth transition to the successor Contractor or transmitted all required documents for MST's records, as determined by MST in its sole discretion.

Upon expiration of this Agreement, Contractor must transfer all other Work Product, including written reports, data, and other relevant information, to MST and the successor Contractor (if applicable). MST will withhold payment of Contractor's final invoice until Contractor has ensured a smooth transition to the successor Contractor or transmitted all required documents for MST's records, as determined by MST in its sole discretion.