6. EXHIBIT A_Information Security and Privacy Requirements Exhibit FINAL.pdf

This is an Information Security and Privacy Requirements Exhibit supporting a Salesforce License Renewal (Brand Only) contract opportunity for the State of California. The exhibit establishes the security and privacy standards that the contractor must maintain throughout the contract term, including requirements for data protection, access controls, encryption, audit logging, and incident response procedures. The document outlines mandatory compliance frameworks and specifies that all systems handling state data must meet federal and state security standards, including NIST Cybersecurity Framework guidelines and California privacy laws. Contractors are required to implement multi-factor authentication, maintain detailed security documentation, conduct regular security assessments, and provide immediate notification of any security breaches or unauthorized access incidents.

The exhibit imposes strict data handling requirements, including restrictions on data storage locations, mandatory encryption of data in transit and at rest, and limitations on third-party access to state information. Contractors must maintain comprehensive audit trails, implement role-based access controls, and undergo regular security testing and vulnerability assessments. The requirements also mandate that contractors maintain cyber liability insurance, provide annual security training documentation, and comply with California Consumer Privacy Act (CCPA) provisions and other state privacy regulations. Contractors are responsible for ensuring subcontractors and vendors meet equivalent security standards, and must establish service level agreements guaranteeing system availability and data protection commitments.