Attachment_D_-_GLO_Information_Security_Appendix.pdf

Attachment E

1. GLO Contract No. 23-160-056-E826

GLO Information Security Appendix

1. Definitions

“Breach of Security” means any unauthorized access of computerized data that compromises the security, confidentiality, or integrity of GLO Data that is in the possession and/or control of

Subrecipient (or any entity with which Subrecipient shares GLO Data as authorized herein) including data that is encrypted if the person accessing the data has the key required to decrypt the data, or a loss of control, compromise, unauthorized disclosure or access, failure to physically secure GLO Data or when unauthorized users access PII or SPI for an unauthorized purposes.

The term encompasses both suspected and confirmed incidents involving GLO Data which raise a reasonable risk of harm to the GLO or an individual. A Breach of Security occurs regardless of whether caused by a negligent or intentional act or omission on part of Subrecipient and/or aforementioned entities.

“GLO Data” means any data or information, which includes PII and/or SPI as defined below, collected, maintained, and created by the GLO, for the purpose of providing disaster assistance to an individual, that Subrecipient obtains, accesses (via records, systems, or otherwise), receives

(from the GLO or on behalf of the GLO), or uses in the performance of the Contract or any documents related thereto. GLO Data does not include other information that is lawfully made available to Subrecipient through other sources.

“Personal Identifying Information” or “PII” means information that alone, or in conjunction with other information, identifies an individual as defined at Tex. Bus. & Com Code Section

521.002(a)(1).

“Sensitive Personal Information” or “SPI” means the personal information identifying an individual as defined at Tex. Bus. & Com. Code Section 521.002(a)(2).

All defined terms found in the Contract shall have the same force and effect, regardless of capitalization.

2. Security and Privacy Compliance

2.1. Subrecipient shall keep all GLO Data received under the Contract and any documents related thereto strictly confidential.

2.2. Subrecipient shall comply with all applicable federal and state privacy and data protection laws, as well as all other applicable regulations.

2.3. Subrecipient shall implement administrative, physical, and technical safeguards to protect GLO Data that are no less rigorous than accepted industry practices including, without limitation, the guidelines in the National Institute of Standards and Technology

(“NIST”) Cybersecurity Framework Version 1.1. All such safeguards shall comply with applicable data protection and privacy laws.

2.4. Subrecipient will legally bind any contractor(s)/subcontractor(s) to the same requirements stated herein and obligations stipulated in the Contract and documents related thereto. Subrecipient shall ensure that the requirements stated herein are imposed on any contractor/subcontractor of Subrecipient’s subcontractor(s).

Docusign Envelope ID: 7BB2888D-18E9-4DBE-AD9C-FD217CDFAC30

2.5. With the exception of contractors and subcontractors as they are addressed in Section

2.4, Subrecipient will not share GLO Data with any third parties, except as necessary for Subrecipient’s performance under the Contract and upon the express written consent of the GLO’s Information Security Officer or his/her authorized designee.

2.6. Subrecipient will ensure that initial privacy and security training, and annual training, thereafter, is completed by its employees or contractor/subcontractors that have access to GLO Data or who create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle PII and/or SPI on behalf of the GLO. Subrecipient shall maintain and, upon request, provide documentation of training completion.

2.7 Any GLO Data maintained or stored by Subrecipient or any contractor/subcontractor must be stored on servers or other hardware located within the physical borders of the

United States and shall not be accessed outside of the United States.

2.8 Subrecipient shall require that all individuals allowed to access GLO Data pursuant to this Contract sign a confidentiality and non-disclosure agreement (“NDA”) before being given access to GLO Data. At a minimum, the NDA shall inform all individuals of the confidential nature of the GLO Data, the security and non-disclosure requirements of this Contract, and the potential criminal penalties and civil remedies specified in federal and state laws that may result from the unauthorized disclosure of

GLO Data. The NDA shall require all individuals to acknowledge that the GLO or the

United States government, including the U.S. Department of Housing and Urban

Development, will seek any remedy available, including all administrative, disciplinary, civil, or criminal action(s) or penalties, as appropriate, for any unauthorized disclosure of GLO Data. Subrecipient shall provide the GLO copies of any and all NDAs upon request or demand by the GLO.

2.9 Subrecipient shall only use GLO Data for the purposes of administering the Project(s).

3. Data Ownership

3.1. The GLO shall retain full ownership of all GLO Data, which includes PII and/or SPI, disclosed to Subrecipient or to which Subrecipient otherwise gains access by operation of the Contract or any agreement related thereto.

3.2. If, at any time during the term of the Contract or upon termination of the Contract, whichever occurs first, any part of the GLO Data, in any form, provided to Subrecipient ceases to be necessary for Subrecipient’s performance under the Contract, Subrecipient shall within fourteen (14) days thereafter securely return such GLO Data to the GLO, or, at the GLO’s written request, destroy, uninstall, and/or remove all copies of data in

Subrecipient’s possession or control and certify to the GLO that such tasks have been completed. Subrecipient shall provide certification of such destruction of GLO Data. If such return is infeasible, as mutually determined by the GLO and Subrecipient, the obligations set forth in this Attachment, with respect to GLO Data, shall survive termination of the Contract and Subrecipient shall prohibit any further use and disclosure of GLO Data.

4. Data Mining

4.1. Subrecipient shall not use GLO Data for unrelated commercial purposes, advertising or advertising-related services, or for any other purpose not explicitly authorized by the

GLO in this Contract.

4.2. Subrecipient shall take all reasonable physical, technical, administrative, and procedural measures to ensure that no unauthorized use or access of GLO Data occurs.

5. Breach of Security

5.1. Subrecipient shall provide the GLO with the name and contact information for an employee of Subrecipient which shall serve as the GLO’s primary security contact.

5.2. Upon Subrecipient’s discovery of a Breach of Security or suspected Breach of Security, Subrecipient shall notify the GLO as soon as possible, but no later than 24 hours after discovery of the Breach of Security or suspected Breach of Security. Within 72 hours, Subrecipient shall provide to the GLO, at minimum, a written preliminary report regarding the Breach or suspected Breach to the GLO with root cause analysis including a log detailing the data affected.

5.3. Subrecipient shall submit the initial notification and preliminary report to the GLO

Information Security Officer at informationsecurity@glo.texas.gov.

5.4. Subrecipient shall take all reasonable steps to immediately remedy a Breach of Security and prevent any further Breach of Security.

5.5. Subrecipient shall not inform any third party of any Breach of Security or suspected

Breach of Security without first obtaining GLO’s prior written consent unless such action is required by law or is limited to third party personnel that have a need to know for the sole purpose of containing or remediating the Breach of Security or suspected

Breach of Security. However, while a third party may be informed of the Breach or suspected Breach for the sole purpose of containing or remediating it, no GLO Data shall be shared with such third party unless express written permission is obtained from the GLO in accordance with Section 2.5. Subrecipient will legally bind such third party to the same requirements stated herein and obligations stipulated in the Contract and documents related thereto as soon as practicable upon securing such third party to contain or remediate the Breach of Security or suspected Breach of Security.

5.6. Notwithstanding the remedies provided in the Contract, if a Breach of Security includes

SPI, Subrecipient shall, at the discretion of the GLO, notify affected individuals of such

Breach and provide affected individuals complimentary access to one (1) year of credit monitoring services.

6. Right to Audit

6.1 Upon the GLO’s request and to confirm Subrecipient’s compliance with this

Attachment, Subrecipient grants the GLO, or a GLO-contracted vendor, permission to perform an assessment, audit, examination, investigation, or review of all controls in

Subrecipient’s, or Subrecipient’s contractor/subcontractor’s, physical and/or technical environment in relation to GLO Data. Subrecipient shall fully cooperate with such mailto:brandon.rogers@glo.texas.gov assessment by providing access to knowledgeable personnel, physical premises, documentation, infrastructure and application software that stores, processes, or transports GLO Data. In lieu of a GLO-conducted assessment, audit, examination, investigation, or review, Subrecipient may supply, upon GLO approval, the following reports: SSAE18, ISO/ICE 27001 Certification, FedRAMP Certification, and PCI

Compliance Report. Subrecipient shall ensure that this clause concerning the GLO’s authority to assess, audit, examine, investigate, or review is included in any contract/subcontract that Subrecipient awards.

6.2 At the GLO’s request, Subrecipient shall promptly and accurately complete a written information security questionnaire provided by the GLO regarding Subrecipient’s business practices and information technology environment in relation to GLO Data and the GLO shall consider such information to be confidential to the extent allowed by law.