Attachment F - ISA - ITN-2026-215-NC.pdf
PDF 286 KB Posted
- Attached to
- MARKETING AND PUBLIC RELATIONS SERVICES
- Solicitation number
- ITN-15536
- Issued by
- Broward County, Fort Lauderdale City, Florida
About this file
This is an Information Security Affidavit (Attachment F) required by Broward College, Florida, in conjunction with ITN-2026-215-NC for Marketing and Public Relations Services. The affidavit establishes mandatory information security requirements that vendors must acknowledge and comply with when handling College data. Vendors must attest to completing specific security tasks including obtaining SOC 2 audit reports, EDUCAUSE HECVAT assessments, or CSA CAIQ assessments to document internal security controls. The affidavit covers sensitive data protection measures for hard copy and electronic formats, including clean desk policies, locked storage, encryption of data at rest and in transit, and system wiping using NIST 800-88 standards prior to disposal. Vendors must acknowledge awareness of their obligations to comply with privacy regulations applicable to any College data accessed, whether directly or indirectly, including FERPA, FACTA, PCI, HIPAA, GLBA, and GDPR.
The affidavit further requires vendors to conduct background checks on all employees with access to College sensitive data and to provide information security awareness training and privacy regulation training to applicable staff. Sensitive data categories identified include Personally Identifiable Information, Medical Information, Academic Information, Business Information, and Financial Information. A designated signing manager for the vendor organization must certify truthfulness of responses and commit to good faith efforts to protect all information handled on behalf of Broward College, with acknowledgment that the College may request verification at any time to ensure compliance with minimum security requirements.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Broward College Information Security Affidavit
I, _______________________________________[Name], the designated signing manager for [Organization], attest to the best of my knowledge, that we completed the following tasks to detect, prevent, and mitigate loss due to an information security breach or identity theft related incident.
Initials
Initials
1. My organization has attached the most recent SOC 2 audit report attesting to our internal security controls. In lieu of a 3rd party audit report we agree to provide an EDUCAUSE HECVAT or a CSA CAIQ assessment. Additional audit reviews or documents may be attached to assist in the vendor risk management review process:
◆ Information Security Policy ◆ Physical Security Policy ◆ ISO Certification ◆ PCI Certification
2. My organization has reasonable security measures to protect sensitive data in both hard copy and electronic formats. This would include clean desk policies and locked cabinets where documents may reside. We also ensure that all sensitive data stored on systems under our control will be encrypted while at rest and in transit. Prior to disposal, systems will be wiped using the NIST 800-88 standard. Broward College sensitive data includes but is not limited to the following:
◆ Personally Identifiable Information (SSN, DOB, Driver’s License Number, Passport Information) ◆ Medical Information (Medical Records, Doctor Names and Claims, Prescription Information) ◆ Academic Information (Transcripts, Grade Information) ◆ Business Information (Federal ID Numbers, Security Systems, Employee Identifiers, Passwords) ◆ Financial Information (Credit Card Information, Bank Account Numbers)
3. My organization is aware of the obligation to adhere to the same information security Initials requirements that the College must adhere to under the common privacy regulations. This is specific to information that we may have direct or indirect access to as part of our services.
◆ Family Educational Rights and Privacy Act (FERPA) ◆ Fair and Accurate Credit Transactions Act (FACTA) ◆ Payment Card Industry (PCI) ◆ Health Insurance Portability and Accountability Act (HIPAA) ◆ Gramm-Leach-Bliley Act (GLBA) ◆ General Data Protection Regulation (GDPR)
4. My organization conducts background checks on all employees that may access sensitive data Initials belonging to the College. We also ensure that employee s are trained in information security best practices prior to completing work on behalf of the College.
◆ Information Security Awareness Training ◆ Background Checks Filed for All employees ◆ Common Privacy Regulation Training (PCI, GLBA, HIPAA)
□ I AGREE THAT I HAVE ANSWERED THE ABOVE QUESTIONS TRUTHFULLY TO THE BEST OF MY
KNOWLEDGE.
□ I AGREE TO MAKE A GOOD FAITH ATTEMPT TO PROTECT ALL INFORMATION MY BUSINESS
HANDLES ON BEHALF OF BROWARD COLLEGE.
□ I UNDERSTAND AND AGREE THAT BROWARD COLLEGE MAY REQUEST VERIFICATION AS
NEEDED TO ENSURE THAT WE MEET THE MINIMUM SECURITY REQUIREMENTS
X
Title Date
ATTACHMENT F
File details come from the government source that posted it. Updated .