AttA_ExI Privacy and Security vf.docx

EXHIBIT I

PRIVACY AND SECURITY REQUIREMENTS

Contractor’s obligations under this Contract include the requirements of this exhibit.

1. PURPOSE. The terms and conditions of this Privacy and Security Requirements exhibit address:

1.1. Contractor’s Use of Agency Data;

1.2. Contractor’s access to State systems and networks;

1.3. Contractor’s Services and delivery of the Solution; and

1.4. The periodic exchange of Agency Data between Agency’s and Contractor’s systems via electronic means.

2. COMPLIANCE REQUIREMENTS.

2.1. Compliance with Laws, Regulations, and Policies. Contractor and its employees, contractors, and agents shall comply with all applicable state and federal laws and regulations, and State of Oregon policies governing use and disclosure of data and access to State of Oregon networks and information systems, including as those laws, regulations, and policies may be updated from time to time. Applicable laws, regulations, and policies include but are not limited to:

2.1.1. The Oregon Consumer Information Protection Act, ORS 646A.600 through 646A.628 (OCIPA). Contractor will have access to documents, records or items that contain “Personal Information,” as that term is used in ORS 646A.602(12), and which is subject to the protections of OCIPA. For purposes of OCIPA, Contractor is a vendor.

2.1.2. Oregon’s Statewide Information Security Standards, found online at: https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspxf, including security controls that meet or exceed “Moderate” security controls in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53.

2.1.3. Oregon’s Statewide Information Security Plan, found online at: https://www.oregon.gov/das/OSCIO/Pages/SecurityGuidance.aspx.

2.1.4. Oregon’s Statewide IT Policies: https://www.oregon.gov/das/Pages/policies.aspx#IT.

3. NOTIFICATIONS.

3.1. Incidents and Breaches. In the event Contractor or its subcontractors or agents discover or are notified of a suspected or confirmed security incident, or a suspected or confirmed breach of security or privacy, Contractor shall notify the State’s Contract Administrator (or delegate) immediately, and in no event more than 24 hours following discovery or notification. An incident is an observable, measurable occurrence that is a deviation from expected operations or activities. A breach includes a failure to comply with Contractor’s confidentiality obligations. If the State determines that an incident or breach requires notification of Agency clients, or other notification required by law, the State will have sole control over the notification content, timing, and method, subject to Contractor’s obligations under applicable law.

3.2. Requests for Agency Data. In the event Contractor receives a third-party request for Agency Data, including any electronic discovery, litigation hold, or discovery searches, Contractor shall first give Agency notice and provide such information as may be reasonably necessary to enable Agency to protect its interests.

4. PRIVACY OBLIGATIONS. In addition to Contractor’s obligations under the terms and conditions of the Contract:

4.1. Generally. Contractor shall hold all Agency Data, and other information as to personal facts and circumstances obtained by Contractor on Agency clients, as confidential, using the highest standard of care applicable to the data, and shall not divulge any Agency Data without the written consent of applicable authority except as required by other terms of this Privacy and Security Requirements exhibit or applicable law. Agency Data shall be separate from vendor or other customer data.

4.2. Limited Purposes. Contractor shall limit the use or disclosure of Agency Data to persons directly connected with the administration of this Contract. Confidentiality policies apply to all requests from outside sources.

4.3. Privacy Protections. Agency Data may include information, such as client records, subject to specified confidentiality protections under state or federal law. Contractor shall comply with laws, regulations, and policies applicable to the information, including as specified in this Contract.

4.4. Training. Contractor’s employees, subcontractors, and agents who will access Agency Data have received training on the privacy and security obligations relating to Agency Data, including client records. Contractor shall provide periodic privacy and security training to its employees, subcontractors, and agents.

4.5. Responsible for Compliance. Contractor is responsible for the compliance of its employees, agents, and subcontractors with this Contract, including this Exhibit I, and with any third-party licenses to which access is subject.

4.6. Privacy and Security Measures. Contractor represents and warrants it has established and will maintain privacy and security measures that meet or exceed the standards set in laws, rules, and regulations applicable to the safeguarding, security, and privacy of Agency Data, including client records, State networks, and information assets, regardless of the media. Contractor shall monitor, periodically assess, and update its security controls and risk to ensure continued effectiveness of those controls.

4.7. Security Risk Management Plan. Contractor shall ensure the level of security and privacy protection required in accordance with this Contract is documented in a security risk management plan. Contractor shall make its security risk management plan available to the State for review upon request.

4.8. Audit Rights and Access. Contractor shall maintain records in such a manner as to clearly document its compliance with and performance under this Privacy and Security Requirements exhibit, and provide Agency, the Oregon Secretary of State, the federal government, and their duly authorized representatives access to Contractor’s officers, agents, contractors, subcontractors, employees, facilities, and records to:

4.8.1. Determine Contractor’s compliance with this Privacy and Security Requirements exhibit,

4.8.2. Validate Contractor’s written security risk management plan, or

4.8.3. Gather or verify any additional information Agency may require to meet any state or federal laws, rules, or orders.

4.8.4. Access to facilities, systems, and records under this section will be granted following reasonable notice to Contractor. Records include paper or electronic form, system security logs, and related system components and tools (including hardware and software), required to perform examinations and audits, and to make excerpts and transcripts, including for data forensics.

5. ACCESS TO STATE SYSTEMS.

5.1. Agency Review of Access Requests. If required for access to State networks and systems, Agency will review requests and will:

5.1.1. Notify Contractor of the approval or denial of its request for each user for whom access has been requested;

5.1.2. Provide any unique log-on identifier required for authorized access;

5.1.3. Provide updates to approved inquiry processes and instructions to Contractor.

5.2. Contractor’s Responsibilities for User Accounts. Contractor shall facilitate completion of any forms for each person for whom access to state networks and systems is requested.

5.2.1. Contractor is responsible for all activities that occur through its access, including for any acts related to a lost or stolen user ID or password.

5.2.2. Contractor is responsible for ensuring information provided by its users is accurate, complete, and up to date.

5.2.3. Contractor shall immediately notify Agency when a user, group of users, or Contractor, no longer requires access, whether due to changes in duties or due to changes in Contractor’s programs related to this Contract.

5.3. Security and Disposal. Contractor shall maintain security of equipment, and ensure the proper handling, storage and disposal of all information assets accessed, obtained, or reproduced by Contractor and its users to prevent inadvertent destruction or loss. Contractor shall ensure proper disposal of equipment and information assets when authorized use ends, consistent with Contractor’s record retention obligations and obligations regarding information assets under this Contract.

5.4. Prevention of Unauthorized Access. Contractor shall prevent any access to State of Oregon networks and information systems by its users that is not authorized in accordance with this Contract and applicable law, and shall implement and maintain safeguards to prevent unauthorized access.

5.5. No Overseas Access. Contractor shall not allow access to Agency Data or the Production Environment from locations outside of the United States or its territories, nor allow use of any information asset in any country or in any manner prohibited by governing applicable law, rule, or policy.

5.6. Authorized Access and Use Only. No user may access or use Agency Data for any purpose other than those specifically authorized through this Contract.

5.6.1. Users shall not use access to obtain or attempt to obtain any Agency Data or information assets not authorized or intentionally made available.

5.6.2. The use and disclosure of any information asset is strictly limited to the minimum information necessary to the exchange of Agency Data between the parties.

5.6.3. Except as otherwise specified or approved by Agency, neither Contractor nor its users may modify, alter, delete, or destroy any information asset.

5.7. Revocation or Termination of Access. Breach, or wrongful use or disclosure of Agency Data or other Confidential Information by Contractor or its users, may cause the immediate revocation of the access granted though this Contract, in the sole discretion of Agency, or Agency may specify a reasonable opportunity for Contractor to cure the unauthorized use or disclosure and end the violation, and terminate the access if Contractor does not do so within the time specified by Agency. Legal actions also may be taken for violations of applicable regulations and laws.

5.8. No Unauthorized Distribution. Contractor shall not sell, make available, or provide Agency Data or other Confidential Information in any form to any other persons or organizations, and shall not use Agency Data or other Confidential Information for any purposes other than as allowed under this Contract and applicable law.

5.9. No Impairment. Contractor shall not use this access in any manner which could damage, disable, overburden, or impair State of Oregon networks or information systems, or interfere with any other entity’s use or benefit of the network and information systems.

5.10. Prohibition on Data Mining. Contractor shall not capture, maintain, scan, index, share or use Agency Data stored or transmitted by virtue of the Services or Solution, or otherwise use any data-mining technology, for any non-authorized activity. For purposes of this requirement, “non-authorized activity” means the data mining or processing of data, stored or transmitted through the Solution or State systems, for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security analysis that is not explicitly authorized in this Contract.

9.11. Incidents and Breaches. Contractor shall comply, and shall cause its subcontractors to comply, with any requirements for identifying and addressing a security incident or breach. This requirement applies regardless of whether the incident or breach was accidental or otherwise.

6. SUSPENSION OR TERMINATION.

6.1. Agency may immediately revoke the access granted Contractor for Contractor’s failure to comply with the requirements of this Privacy and Security Requirements exhibit. In such event, Agency will provide subsequent written notice to Contractor’s point of contact. Agency may, to the extent it determines it is reasonable and able to do so, provide advance notice to Contractor to cure any deficiency or breach of this Privacy and Security Requirements exhibit.

6.2. Either party may terminate access under this Privacy and Security Requirements exhibit, and Agency may modify access, upon written notice if there are changes to or revised interpretations of federal or state laws, rules, or regulations, or if either party has changes in policies that require such action.

7. RETURN OF AGENCY DATA. Upon expiration or termination of the Contract for any reason whatsoever, Contractor shall immediately deliver to Agency all of Agency’s information assets, including Agency Data, that are in the possession or under the control of Contractor in whatever stage and in a format acceptable to Agency.

7.1. Except as necessary to meet obligations under Contract Section 22, Records Maintenance and Access, Contractor shall not retain any copies of Agency Data or other electronic Confidential Information. Contractor shall notify Agency of any conditions that make returning all such Agency property not feasible. Upon Agency’s written acknowledgement that returning all Agency Data and electronic Confidential Information is not feasible, Contractor shall purge or destroy retained Agency Data and electronic Confidential Information in all its forms in accordance with the most current version of NIST SP 800-88 (or other agreed-upon standard) and on request provide Agency with written certification of sanitization.

7.2. Contractor shall maintain protections required by law or the Contract for any retained Agency Data and electronic Confidential Information for so long as Contractor (including through any subcontractor) retains it.

7.3. Contractor shall notify Agency of any conditions that make returning all Agency Data not feasible, and shall not dispose of Agency Data without Agency’s written authorization. Upon Agency’s written acknowledgement that returning all Agency Data is not feasible and consent, Contractor shall purge or destroy retained Agency Data in all its forms (including copies of returned data) in accordance with the most current version of NIST SP 800-88 [or other agreed-upon standard] and provide Agency with written certification of sanitization.

8. COSTS. Each party will bear its own costs related to the acquisition of all equipment, software, data lines or connections necessary for access to State of Oregon networks and information systems, unless otherwise agreed to by written agreement between the parties. Each party is responsible for securing compatible hardware, equipment, software, and network connections. Each party is responsible for complying with the licenses for third party products, including software and services that allow access.

9. INTERPRETATION. Any ambiguity in this Privacy and Security Requirements Exhibit will be resolved to permit Agency to comply with applicable privacy and security laws and State of Oregon and Agency policies interpreting those laws.

10. SUBCONTRACTORS. Contractor shall ensure all subcontractors providing services related to this Privacy and Security Exhibit comply with its terms.

IT Template Consulting Services V6 March 2022 (38334154) Page 34 of 48