Cloud_Hosting_Policy.pdf
PDF 75 KB Posted
- Solicitation number
- 27-P-00001
- Issued by
- Hillsborough County, Florida
About this file
Cybersecurity Provisions for Purchasing Contracts - City of Tampa
This document is a cybersecurity exhibit attachment to be incorporated into purchasing contracts between the City of Tampa, Florida and contracted vendors. The provisions establish mandatory cybersecurity requirements and standards that vendors must implement and maintain throughout the contract term. The exhibit covers data security and protection obligations, compliance with applicable laws and regulations including GDPR, CCPA, NIST Cybersecurity Framework, PCI-DSS, CJIS, and HIPAA, and requirements for maintaining administrative, technical, and physical security controls. Vendors are required to notify the City within forty-eight hours of discovering any cybersecurity incident, including data breaches, unauthorized access, or ransomware attacks, and must cooperate fully in incident investigations and remediation efforts. The provisions also require vendors to restrict data access to authorized personnel only, prohibit data retention beyond the contract term without written agreement, and mandate secure disposal or return of all City data upon contract termination.
The exhibit establishes additional vendor obligations including ensuring that all subcontractors and third-party providers adhere to the same cybersecurity standards, with the vendor remaining fully responsible for data security throughout the supply chain. Vendors must continuously monitor and update cybersecurity measures in response to emerging threats and must promptly communicate any significant changes to security policies to the City. The City reserves the right to terminate the Agreement without penalty if the vendor fails to comply with cybersecurity provisions, provided the vendor receives written notice and ten days to cure the deficiency or demonstrate diligent corrective action efforts. All data collected, processed, stored, or transmitted under the Agreement must remain within data centers physically located in the continental United States unless the City provides prior written consent otherwise. Vendors are required to indemnify and hold harmless the City from claims, damages, or losses resulting from cybersecurity breaches attributable to the vendor's failure to implement appropriate security measures, including all costs associated with breach response and regulatory fines.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
#VWKB44QJ0D3Z38v1
Exhibit __ Cybersecurity Provisions for Purchasing Contracts
This Cybersecurity Provisions for Purchasing Contracts between the City of Tampa (“City”) and _____ (“Vendor”) is attached to and incorporated into _____ (“the Agreement”) as Exhibit ____.
1. Data Security and Protection. The Vendor shall implement and maintain industry-standard cybersecurity measures to protect the confidentiality, integrity, and availability of all data, including personally identifiable information and proprietary business information, that is processed, stored, or transmitted in connection with the Agreement.
2. Compliance with Laws and Standards. The Vendor shall comply with all applicable data security and privacy laws, regulations, and industry standards, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the Payment Card Industry Data Security Standard (PCI-DSS), Criminal Justice Information Services (CJIS), Health Insurance Portability and Accountability Act (HIPAA), and any other relevant guidelines.
3. Security Controls and Audits. The Vendor agrees to maintain appropriate administrative, technical, and physical controls to ensure the security of systems and data. The Vendor shall provide, upon request, documentation detailing these controls.
4. Incident Response and Notification. If there is a cybersecurity incident, including a data breach, unauthorized access, or a ransomware attack, the Vendor shall notify the City within forty-eight (48) hours of discovering such incident. The Vendor shall cooperate fully in investigating the incident and take all necessary corrective actions to mitigate the impact and prevent future occurrences.
5. Data Access and Retention. The Vendor shall ensure that access to data is restricted to authorized personnel only and that appropriate authentication and access controls are in place. The Vendor shall not retain data beyond the duration of the Agreement unless otherwise agreed to in a writing signed by both parties and shall securely dispose of or return all the City’s data upon contract termination to the extent permitted by applicable law.
6. Subcontractors and Third-Party Providers. The Vendor shall ensure that any subcontractors or third-party providers engaged in fulfilling the Agreement adhere to the same cybersecurity standards and obligations outlined herein. The Vendor remains fully responsible for the security and integrity of the City’s data handled by subcontractors.
7. Indemnification and Liability. The Vendor shall indemnify and hold harmless the City and the City’s officers, elected and appointed officials, agents, and employees from any claims, damages, or losses resulting from a cybersecurity breach attributable to the Vendor’s failure to implement appropriate security measures. The Vendor shall assume
#VWKB44QJ0D3Z38v1 all costs associated with response to the breach, including notification, credit monitoring, and regulatory fines, if applicable.
8. Continuous Improvement and Updates. The Vendor shall continuously monitor and update cybersecurity measures in response to emerging threats and technological advancements. If the Vendor makes any significant changes to security policies or practices, the Vendor must promptly communicate such to the City.
9. Termination for Security Non-Compliance. The City reserves the right to terminate the Agreement without penalty if the Vendor fails to comply with the cybersecurity provisions set forth herein. If the Vendor fails to comply, unless a significant security risk exists, the City shall notify the Vendor of such noncompliance, and the Vendor has ten (10) days after the day it receives such notice to correct such failure or demonstrate to the City that the Vendor is diligently correcting such failure. If after the ten (10) day period the Vendor has failed to correct such failure or, in the City’s sole judgment, has failed to demonstrate the Vendor is diligently correcting the failure, the City may terminate the Agreement.
10. Data Storage and Processing Location. Unless given the City’s prior written consent to act otherwise, the Vendor shall ensure that all data collected, processed, stored, or transmitted under the Agreement, including all data stored or processed through subcontractors, cloud services, and third-party providers, remains within data centers physically located in the continental United States.
File details come from the government source that posted it. Updated .