Cloud_Hosting_Policy.pdf

#VWKB44QJ0D3Z38v1

Exhibit __ Cybersecurity Provisions for Purchasing Contracts

This Cybersecurity Provisions for Purchasing Contracts between the City of Tampa (“City”) and _____ (“Vendor”) is attached to and incorporated into _____ (“the Agreement”) as Exhibit ____.

1. Data Security and Protection. The Vendor shall implement and maintain industry-standard cybersecurity measures to protect the confidentiality, integrity, and availability of all data, including personally identifiable information and proprietary business information, that is processed, stored, or transmitted in connection with the Agreement.

2. Compliance with Laws and Standards. The Vendor shall comply with all applicable data security and privacy laws, regulations, and industry standards, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the Payment Card Industry Data Security Standard (PCI-DSS), Criminal Justice Information Services (CJIS), Health Insurance Portability and Accountability Act (HIPAA), and any other relevant guidelines.

3. Security Controls and Audits. The Vendor agrees to maintain appropriate administrative, technical, and physical controls to ensure the security of systems and data. The Vendor shall provide, upon request, documentation detailing these controls.

4. Incident Response and Notification. If there is a cybersecurity incident, including a data breach, unauthorized access, or a ransomware attack, the Vendor shall notify the City within forty-eight (48) hours of discovering such incident. The Vendor shall cooperate fully in investigating the incident and take all necessary corrective actions to mitigate the impact and prevent future occurrences.

5. Data Access and Retention. The Vendor shall ensure that access to data is restricted to authorized personnel only and that appropriate authentication and access controls are in place. The Vendor shall not retain data beyond the duration of the Agreement unless otherwise agreed to in a writing signed by both parties and shall securely dispose of or return all the City’s data upon contract termination to the extent permitted by applicable law.

6. Subcontractors and Third-Party Providers. The Vendor shall ensure that any subcontractors or third-party providers engaged in fulfilling the Agreement adhere to the same cybersecurity standards and obligations outlined herein. The Vendor remains fully responsible for the security and integrity of the City’s data handled by subcontractors.

7. Indemnification and Liability. The Vendor shall indemnify and hold harmless the City and the City’s officers, elected and appointed officials, agents, and employees from any claims, damages, or losses resulting from a cybersecurity breach attributable to the Vendor’s failure to implement appropriate security measures. The Vendor shall assume

#VWKB44QJ0D3Z38v1 all costs associated with response to the breach, including notification, credit monitoring, and regulatory fines, if applicable.

8. Continuous Improvement and Updates. The Vendor shall continuously monitor and update cybersecurity measures in response to emerging threats and technological advancements. If the Vendor makes any significant changes to security policies or practices, the Vendor must promptly communicate such to the City.

9. Termination for Security Non-Compliance. The City reserves the right to terminate the Agreement without penalty if the Vendor fails to comply with the cybersecurity provisions set forth herein. If the Vendor fails to comply, unless a significant security risk exists, the City shall notify the Vendor of such noncompliance, and the Vendor has ten (10) days after the day it receives such notice to correct such failure or demonstrate to the City that the Vendor is diligently correcting such failure. If after the ten (10) day period the Vendor has failed to correct such failure or, in the City’s sole judgment, has failed to demonstrate the Vendor is diligently correcting the failure, the City may terminate the Agreement.

10. Data Storage and Processing Location. Unless given the City’s prior written consent to act otherwise, the Vendor shall ensure that all data collected, processed, stored, or transmitted under the Agreement, including all data stored or processed through subcontractors, cloud services, and third-party providers, remains within data centers physically located in the continental United States.