6-Attachment B - IT Inclusions.pdf

ATTACHEMNT B

1. Breach Notification

1.1. Notification of Breach

1.1.1. Immediate Notification: Vendor shall notify the Agency in writing of any actual or suspected Breach within [X] hours of discovery, and in no event later than [72 hours] after becoming aware of such Breach.

1.1.2. Initial Notice Content: The initial notice shall include, to the extent known at the time:

1.1.2.1. A general description of the nature of the Breach;

1.1.2.2. The date and time of the Breach, and when it was discovered;

1.1.2.3. The types of Agency Data involved;

1.1.2.4. The potential number of aƯected individuals or records;

1.1.2.5. Actions taken or planned to contain, mitigate, and remediate the Breach; and

1.1.2.6. Contact information for a Vendor representative authorized to respond to the Breach.

1.1.3. Ongoing Updates: Vendor shall provide regular updates to the Agency regarding the status of the investigation, mitigation eƯorts, and remedial actions until the incident is fully resolved.

1.2. Cooperation and Investigation

1.2.1. Vendor shall fully cooperate with the Agency and its designated representatives in the investigation, mitigation, and remediation of any Breach.

1.2.2. Vendor shall provide access to all relevant records, logs, personnel, and systems as reasonably necessary for the Agency to investigate and respond to the Breach

1.2.3. Vendor shall not notify any third party, including aƯected individuals or regulators, without prior written approval from the Agency, except as required by law.

1.3. Remediation and Corrective Action

1.3.1. Vendor shall promptly take all necessary steps to mitigate the eƯects of the Breach and prevent recurrence, at its own expense.

1.3.2. Vendor shall, upon request, develop and implement a corrective action plan approved by the Agency.

1.4. Costs and Liability

1.4.1. Vendor shall bear all costs associated with investigating, mitigating, and remediating any Breach resulting from Vendor’s acts or omissions, including but not limited to:

1.4.1.1. Costs of notification to aƯected individuals and regulators (if required by law);

1.4.1.2. Credit monitoring and identity theft protection services (if applicable);

1.4.1.3. Reasonable attorney’s fees and other expenses incurred by the Agency related to the Breach.

1.5. Compliance with Law

1.5.1. Vendor shall comply with all applicable federal, state, and local data protection, privacy, and breach notification laws and regulations.

1.5.2. Vendor shall notify the Agency of any legal obligations related to the Breach that may aƯect the Agency’s rights or responsibilities.

1.6. Survival

1.6.1. The obligations set forth in this Breach Notification Policy shall survive termination or expiration of this Agreement for so long as the Vendor retains, has access to, or possesses Agency Data.

2. Security Requirements

2.1. SOC 2 Type 2 Compliance Requirement

2.1.1. Vendor shall maintain a current SSAE 18 SOC 2 Type 2 audit covering all systems, infrastructure, and services used to provide the contracted solution.

The following requirements apply:

2.1.2. Annual Audit Requirement: Vendor shall obtain and maintain an independent SOC 2 Type 2 audit on an annual basis, conducted by a qualified third-party auditor, and shall provide the Agency with a copy of the resulting report (or a mutually agreed-upon summary) upon request.

2.1.3. Pre-Contract Review: During the project analysis phase and prior to contract execution, the Agency’s IT department shall review the Vendor’s most recent SOC 2 Type 2 report to evaluate the adequacy of Vendor’s security controls. The results of this review will be documented as part of the project analysis.

2.1.4. Ongoing Compliance: Following contract execution, the Vendor shall provide the Agency with its updated SOC 2 Type 2 audit report annually, and the Agency’s IT department shall review and document this review to ensure continued compliance.

2.1.5. Notification of Findings: Vendor shall promptly notify the Agency of any significant findings, exceptions, or material weaknesses identified in the SOC 2 Type 2 report, and shall provide a corrective action plan upon request.

3. Data Ownership and Control

3.1.1. Ownership of Data: All data, records, files, and information, in any form or format, that the Agency provides to the Vendor, or that is collected, generated, processed, stored, or transmitted by the Vendor on behalf of the Agency (“Agency Data”), shall remain the sole and exclusive property of the Agency.

Vendor shall have no ownership, interest, or rights in or to the Agency Data, except as necessary to perform its obligations under this Agreement.

3.1.2. Use of Data: Vendor shall use Agency Data solely for the purpose of providing services under this Agreement and shall not access, disclose, sell, rent, or otherwise use Agency Data for any other purpose without the Agency’s prior written consent.

3.1.3. Access to Data: The Agency shall have the right to access Agency Data at any time, without restriction. Vendor shall provide reasonable assistance, including tools and documentation, to enable the Agency to retrieve, review, or export Agency Data during the term of this Agreement.

3.1.4. Return or Destruction of Data: Upon termination or expiration of this Agreement, or upon the Agency’s written request, Vendor shall promptly return all Agency Data in a mutually agreed-upon, industry-standard format, and shall certify in writing that all Agency Data, including backups, has been securely deleted from Vendor’s systems, except to the extent retention is required by law.

3.1.5. Protection of Data: Vendor shall implement and maintain appropriate administrative, technical, and physical safeguards to protect Agency Data from unauthorized access, disclosure, alteration, or destruction, consistent with industry best practices and applicable law.

3.1.6. Survival: The obligations in this section shall survive termination or expiration of this Agreement for so long as the Vendor retains, has access to, or possesses Agency Data.

4. Disaster Recovery and Business Continuity

4.1. Disaster Recovery Plan: Vendor shall develop, implement, and maintain a current, comprehensive Disaster Recovery and Business Continuity Plan (“DR Plan”) designed to ensure the availability, integrity, and recoverability of all systems, services, and Agency Data provided under this Agreement. The DR Plan shall include, at a minimum:

4.1.1. (a) Defined recovery time objectives (RTOs) and recovery point objectives (RPOs) aligned with the Agency’s requirements;

4.1.2. (b) Identification of critical systems, applications, and data, and the processes to restore them;

4.1.3. (c) Backup and redundancy procedures to prevent data loss;

4.1.4. (d) Procedures for communication with the Agency in the event of a disaster or major service disruption; and

4.1.5. (e) Testing and validation of the DR Plan at least annually.

4.2. Provision of Plan: Vendor shall provide the Agency with a complete copy of its current DR Plan within [14] days of contract execution and upon any material update or revision to the Plan.

4.3. Testing and Results: Vendor shall conduct regular tests of the DR Plan, at least annually, and shall provide the Agency with a summary of test results, including any deficiencies identified and corrective actions taken.

4.4. Notification of Events: Vendor shall notify the Agency immediately of any disaster, service disruption, or other event that materially impacts the availability of services or the integrity of Agency Data, and shall provide ongoing status updates until full restoration of services.

4.5. Right to Review and Audit: The Agency reserves the right to review the DR Plan and, upon reasonable notice, to audit Vendor

5. Data Integration and Interoperability

5.1. Integration Requirement: Vendor shall design, implement, and maintain a secure, reliable, and fully functional data integration between the Computerize Maintenance Management System (CMMS) and Bernalillo County’s Enterprise Resource Planning (ERP) system, SAP, to ensure seamless data exchange necessary for the Agency’s operations.

5.2. Data Exchange Standards: All data transfers shall:

5.2.1. Utilize industry-standard, secure data exchange protocols (e.g., REST APIs, SFTP, or equivalent);

5.2.2. Support real-time or scheduled data synchronization, as required by the

Agency;

5.2.3. Include validation and error-handling processes to ensure data accuracy and integrity.

5.3. Maintenance and Support: Vendor shall be responsible for the ongoing maintenance, monitoring, and support of the data integration, including timely resolution of any errors, disruptions, or failures aƯecting data exchange between the CMMS and SAP.

5.4. Change Management: Vendor shall promptly notify the Agency of any changes to the CMMS system or the integration interface that could aƯect data exchange.

Vendor shall coordinate with the Agency to ensure uninterrupted data flow and compliance with Agency requirements.

5.5. Testing and Certification: Vendor shall conduct integration testing prior to initial deployment and following any significant updates to the integration or either system. Vendor shall provide test results and obtain written Agency approval before implementation into the production environment.

5.6. Data Security: Vendor shall ensure that all data transmitted between the CMMS and SAP is encrypted in transit and at rest, and shall comply with all applicable security, privacy, and confidentiality requirements set forth in this Agreement.

5.7. Right to Audit: The Agency reserves the right to review and audit the integration process, including access to technical documentation, performance metrics, and logs related to the integration.