6-6. ATTACHMENT C – DATA SECURITY ADDENDUM.pdf

Attachment C - Data Security Addendum for inclusion in GMU-SS0922-25 with

George Mason University (the “University”)

This Addendum supplements the above-referenced Contract between the University and Full legal name of Firm/Vendor (“Selected

Firm/Vendor”) as of the Effective Date (the “Contract”). It is applicable only in those situations where the Selected Firm/Vendor provides goods or services under the Contract or a Purchase Order which necessitate that the Selected Firm/Vendor create, obtain, transmit, use, maintain, process, store, or dispose of University’s Protected Data (as defined in the Definitions Section of this Addendum) as part of its work under the Contract.

This Addendum sets forth the terms and conditions pursuant to which Protected Data will be safeguarded by the Selected Firm/Vendor during the term of the Parties’ Contract and after its termination.

1. Definitions

Terms used herein shall have the same definition as stated in the Contract. Additionally, the following definitions shall apply to this

Addendum.

a. “Personally Identifiable Information (“PII”)” means any information that can be connected to a specific person and may include but is not limited to personal identifiers such as name, address, phone, date of birth, Social Security number, student or personal identification numbers, driver’s license numbers, state or federal identification numbers, non-directory information and any other information protected by state or federal privacy laws.

b. “University Data” includes all University owned Personally Identifiable Information and other information that is not intentionally made generally available by the University on public websites, including but not limited to business, administrative and financial data, intellectual property, and patient, student and personnel data.

c. “Protected Data” means data identified by University to Selected Firm/Vendor as Protected Data and may include, but is not limited to: (1) PII; (2) credit card data; (3) financial or business data which has the potential to affect the accuracy of the

University’s financial statements; (4) medical or health data; (5) sensitive or confidential business information; (6) trade secrets;

(7) data which could create a security (including IT security) risk to the University; and (8) confidential student or employee information. ‘Protected Data’ includes both Highly Sensitive and Restricted categories of data as defined in the University

Policy 1114 Data Stewardship.

d. “Securely Destroy” means taking actions that render data written on media unrecoverable by both ordinary and extraordinary means. These actions must meet or exceed those sections of the National Institute of Standards and Technology (NIST) SP

800-88 guidelines relevant to data categorized as high security.

e. “Security Breach” means a security-relevant event in which the security of a system or procedure used to create, obtain, transmit, maintain, use, process, store or dispose of data is breached, and in which University Data is exposed to unauthorized disclosure, access, alteration, or use.

f. “Services” means any goods or services acquired by the University from the Selected Firm/Vendor.

2. Data Security

a. In addition to the security requirements stated in the Contract, Selected Firm/Vendor warrants that all electronic Protected Data will be encrypted in transmission (including via web interface) and stored at AES-128 encryption or greater. Additionally, Selected Firm/Vendor warrants that all Protected Data shall be Securely Destroyed, when destruction is requested by the

University.

b. If Selected Firm/Vendor’s use of Protected Data include the storing, processing or transmitting of credit card data for the

University, Selected Firm/Vendor represents and warrants that for the life of the Contract and while Selected Firm/Vendor has possession of University customer cardholder data, the software and services used for processing transactions shall be compliant with standards established by the Payment Card Industry (PCI) Security Standards Council

(www.pcisecuritystandards.org). In the case of a third-party application, the application will be listed as PA-DSS compliant at the time of implementation by the University. Selected Firm/Vendor acknowledges and agrees that it is responsible for the security of all University customer cardholder data or identity information managed, retained, or maintained by Selected

Firm/Vendor, including but not limited to protecting against fraudulent or unapproved use of such credit card or identity information. Selected Firm/Vendor agrees to indemnify and hold University, its officers, employees, and agents, harmless for, from, and against any and all claims, causes of action, suits, judgments, assessments, costs (including reasonable attorneys' fees), and expenses arising out of or relating to any loss of University customer credit card or identity information managed, retained, or maintained by Selected Firm/Vendor, including but not limited to fraudulent or unapproved use of such credit card or identity information. Selected Firm/Vendor shall, upon written request, furnish proof of compliance with the Payment Card

Industry Data Security Standard (PCI DSS) within 10 business days of the request. Selected Firm/Vendor agrees that, notwithstanding anything to the contrary in the Contract or the Addendum, the University may terminate the Contract immediately without penalty upon notice to the Selected Firm/Vendor in the event Selected Firm/Vendor fails to maintain compliance with the PCI DSS or fails to maintain the confidentiality or integrity of any cardholder data.

https://universitypolicy.gmu.edu/policies/data-stewardship/ https://universitypolicy.gmu.edu/policies/data-stewardship/ http://www.pcisecuritystandards.org/

3. Employee Background Checks and Qualifications

a. In addition to the employee background checks provided for in the Contract, Selected Firm/Vendor shall perform the following background checks on all employees who have potential to access Protected Data: Social Security Number trace; seven (7) year felony and misdemeanor criminal records check of federal, state, or local records (as applicable) for job related crimes;

Office of Foreign Assets Control List (OFAC) check; Bureau of Industry and Security List (BIS) check; and Office of Defense

Trade Controls Debarred Persons List (DDTC).

4. Insurance

a. In addition to the insurance requirements outlined in the Contract, Selected Firm/Vendor agrees to maintain Cyber Liability

Insurance in an amount not less than $2,000,000 per incident, for the entire term of the Contract. The Commonwealth of

Virginia and the University shall be named as an additional insured.

5. Security Breach

a. Liability. In addition to any other remedies available to the University under law or equity, Selected Firm/Vendor will reimburse the University in full for all costs incurred by the University in investigation and remediation of any Security Breach of

Protected Data, including but not limited to providing notification to individuals whose Personally Identifiable Information was compromised and to regulatory agencies or other entities as required by law or contract; providing one year’s credit monitoring to the affected individuals if the Personally Identifiable Information exposed during the breach could be used to commit financial identity theft; and the payment of legal fees, audit costs, fines, and other fees imposed by regulatory agencies or contracting partners as a result of the Security Breach.

6. Audits

a. Selected Firm/Vendor will at its expense conduct or have conducted at least annually a: i) security audit with audit objectives deemed sufficient by the University, which attests the Selected Firm/Vendor’s security policies, procedures and controls; ii) vulnerability scan, performed by industry-standard and up-to-date scanning technology, of Selected Firm/Vendor’s electronic systems and facilities that are used in any way to deliver electronic services under the Contract; and iii) formal penetration test, performed by a process and qualified personnel approved by the University, of Selected Firm/Vendor’s electronic systems and facilities that are used in any way to deliver electronic services under the Contract.

b. Additionally, the Selected Firm/Vendor will provide the University upon request the results of the above audits, scans and tests, and will promptly modify its security measures as needed based on those results in order to meet its obligations under the

Contract. The University may require, at University expense, the Selected Firm/Vendor to perform additional audits and tests, the results of which will be provided promptly to the University.

c. Selected Firm/Vendor must provide the University with its current industry standard independent third-party certification/attestation such as Service Organization Control (SOC) 2 Type II audit report, ISO27001/2 or equivalent, and provide a list of all subservice provider(s) relevant to the contract. The University shall have sole discretion to determine whether the audit report/certification/attestation provided is sufficient to satisfy the requirements of this paragraph. It is further agreed that such industry standard audit report/certificate/attestation, will be made available free of cost to the University, will be provided upon issuance by the auditor on an annual-basis. The report should be directed to the appropriate representative identified by the University. Selected Firm/Vendor also commits to providing the University with a designated point of contact for these reports, addressing issues raised in the report including if issues have been cited with the subservice provider(s), and responding to any follow up questions posed by the University in relation to the SOC report. Selected Firm/Vendor agrees to be held legally accountable for the accuracy of any self-attestations provided by the Selected Firm/Vendor towards fulfilling the requirements within this addendum.

IN WITNESS WHEREOF, this Addendum has been executed by an authorized representative of each party as of the date set forth beneath such party’s designated representative’s signature.

Selected Firm/Vendor George Mason University

Signature Signature

Name: Name:

Title: Title:

Date: Date: