B-2_Article_X_Subcontractor_Cyber_Security_Requirements.pdf
PDF 78 KB Posted
- Attached to
- MISK1_S_SP_HP
- Solicitation number
- SLAC_MISK1_S_SP_HP_367608
- Issued by
-
Department of Energy Office of Science
About this file
This document is a contractual clause titled "Article X - Subcontractor Cyber Security Requirements" that establishes mandatory cybersecurity and data handling obligations for subcontractors working with Stanford University.
The clause requires subcontractors to handle all University data according to Stanford's Minimum Security Standards (incorporated by reference at https://minsec.stanford.edu) with a standard of care at least as rigorous as those Guidelines specify. Prior to accessing, transmitting, or storing University Moderate or High Risk Data, subcontractors must obtain third-party certification verifying compliance capability through the specified ASP portal. Subcontractors are prohibited from copying, using, or disclosing University data except as permitted by the Agreement, required by law, or authorized in writing by the University. The clause mandates immediate notification to the University of any actual or suspected unauthorized data disclosure, access, or breach, and requires subcontractors to comply with all applicable state and federal breach notification laws while cooperating with the University's legal obligations. Subcontractors assume full indemnification responsibility for violations, including costs for breach notification and credit monitoring services. Upon agreement termination or expiration, subcontractors must return or destroy all data within 30 days at the University's election. This paragraph and its indemnity provisions survive contract termination.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Article X - Subcontractor Cyber Security Requirements
Subcontractor agrees to handle data and other information ("Data") with a standard of care at least as rigorous as that specified in the University's Minimum Security Standards, located at https://minsec.stanford.edu ("Guidelines"), which are hereby incorporated by reference into the Agreement. Prior to performing Services which require access to, transmission of, and/or storage of the University's Moderate or High Risk Data, as defined in the Guidelines, Subcontractor will provide a third party certification (https://uit.stanford.edu/security/asp) verifying its ability to comply with the Guidelines. Subcontractor will not copy, cause to be copied, use or disclose Data received from or on behalf of the University except as permitted or required by the Agreement, as required by law, or as otherwise authorized by the University in writing.
Subcontractor will give immediate notice to the University of any actual or suspected unauthorized disclosure of, access to or other breach of the Data. In the event of actual or suspected unauthorized disclosure of, access to, or other breach of the Data, Subcontractor will comply with all state and federal laws and regulations related to such breach, and will cooperate with the University in fulfilling its legal obligations. Subcontractor will indemnify the University for its violation of this paragraph, including but not limited to the cost of providing appropriate notice to all required parties and credit monitoring, credit rehabilitation, or other credit support services to individuals with information impacted by the actual or suspected breach. Upon termination or expiration of the Agreement, Subcontractor will return or, at the University's election, destroy, the Data within 30 days from the conclusion of the Agreement. This paragraph and its indemnity will survive the termination of the Agreement.
https://minsec.stanford.edu/ https://uit.stanford.edu/security/asp
File details come from the government source that posted it. Updated .