4. INFORMATION SECURITY AND PRIVACY REQUIREMENTS EXHIBIT_2M.pdf

This Information Security and Privacy Requirements Exhibit is a supporting document for a Fortinet renewal contract opportunity in California. The exhibit establishes the security and privacy standards that the contractor must comply with throughout the contract term. The document outlines mandatory requirements for protecting information systems, data, and privacy in accordance with state and federal regulations. These requirements apply to all contract activities, personnel, and systems that handle or process sensitive information related to the state's operations. The contractor must implement security controls, conduct risk assessments, maintain audit logs, and establish incident response procedures to safeguard information assets against unauthorized access, disclosure, or modification.

The exhibit specifies privacy obligations requiring the contractor to comply with applicable laws including the California Consumer Privacy Act and federal privacy standards. The contractor must implement data protection measures, establish access controls, conduct security training, and report any security incidents or breaches to the state within defined timeframes. Requirements include maintaining system documentation, undergoing security assessments and audits, implementing encryption standards, and ensuring secure disposal of sensitive information. The contractor is responsible for ensuring all subcontractors and personnel comply with these information security and privacy requirements throughout the contract performance period.