Exhibit_1_Terms_and_Conditions_Principles_for_a_Cloud_Hosted_Solution.pdf

Revised - February 5, 2016

TERMS & CONDITIONS PRINCIPLES

FOR A CLOUD-HOSTED SOLUTION

The following are selected principles upon which the winning bidder ("Proposer") proposes to base a cloud-hosted software solution for the Orlando Utilities Commission (OUC).

These principles reflect key topics that will need to be addressed in the resulting supply or services contract (Cloud Agreement). They are not intended to reflect final contractual language or to address every provision which the parties may incorporate into a final agreement. The specific final contractual language shall be as agreed to by the parties prior to the execution of the Cloud Agreement.

1. ACCESS TO PUBLIC RECORDS

The vast majority of OUC records and data will be considered “Public Records” under Florida Law. “Public Records” are defined in Section 119.001(12), Florida Statutes as “. . . all documents, papers, letters, maps, books, tapes, photographs, films, sound recordings, data processing software, or other material, regardless of the physical form, characteristics, or means of transmission, made or received pursuant to law or ordinance or in connection with the transaction of official business by any agency.” Any OUC data that will be hosted on a cloud-based solution provided will be subject to following requirements:

1) Protection of Data Proposer will be limited in its ability to delete OUC Public Records. If certain Public Records are found to violate Proposer’s policies, Proposed may segregate such material and make available for OUC to copy prior to any deletion.

2) Limitation of Rights and Remedies of Proposer The contract remedies of the Proposer for default of other violations of policy by OUC under the terms of the cloud-based solution proposed will be limited to the extent that OUC Public Records are stored on the Proposer’s cloud solution. The following will be considered acceptable remedies for Proposer under any such program contract:

a. Termination Subject to Access and Copying Rights. If at any time OUC is in default of otherwise not performing under the terms of the contract for the Proposer’s cloud-based solution, Proposer’s Termination remedies will be conditioned on the following:

i. OUC shall have the right to access Public Information for a defined period of time after a termination event, even where the fault is with OUC; and,

ii. OUC shall have the right to copy any such Public Records on the cloud-hosted solution for a defined period of time after termination and prior to deletion by the Proposer.

EXHIBIT 1

3) Force Majeure

Should the contract include a force majeure provision, such provision will not relieve Proposer of the duty to provide access to Public Records.

4) Governing Law

The contract for the cloud solution will acknowledge that the public records requirements and terms will be governed by Florida Law.

2. IT SECURITY REQUIREMENTS

Any cloud-based solution contract with the Proposer will be subject to specific security protocols and protections that comply with OUC’s standards for Public Records. The following security requirements and those in the entire RFP shall apply to Proposer’s cloud-based solutions.

The solution must comply with OUC’s IT standards, including the password standard and hardware/software standards.

The shortlisted vendors agree to respond fully to a detailed questionnaire on the vendor’s security controls.

prior to deletion by the Proposer.

b. Suspension Subject to Access and Copying Rights. If at any time OUC is in default of otherwise not performing under the terms of the contract for the Proposer’s cloud-based solution, Proposer’s suspension of service rights will be conditioned upon the following:

i. OUC shall have the right to access Public Records, even if OUC can’t add to the Public Records or use any of the other services offered; and,

ii. Rights of OUC to access and download the Public Records if suspension leads to termination; and,

iii. If suspension or termination result in blocking OUC access to the Public Records, then Proposer will be required to acknowledge the Proposer is assuming the role as records custodian under the Florida Statutory requirements for the preservation of Public Records; as such, there will need to be a provision for a notice process whereby OUC will provide notices and inform Proposer as the records custodian of what Public Records must be provided if requested by a member of the public; and,

iv. Proposer may not charge for access to Public Records if provided in response to a public records request under Chapter 119, Florida Statutes.

1) Data Management

a. Separation from Other Clients’ Data Data classified as privileged or private will be hosted within a separate instance on any server and not mixed with other companies’ data.

b. Encryption Data classified as privileged or private will be encrypted or otherwise significantly protected in transit, in process, and at rest.

c. Storage and Transmission Limited to North America OUC data must be stored and transmitted only within North America.

d. Backup OUC data will be backed up on a regular basis and retained according to OUC’s stated requirements. OUC data will be backed up:

Hourly Every hours Daily Weekly Monthly

e. Disposal The vendor(s) must provide a secure method for data and equipment disposal.

f. Third-Party Attestation The vendor(s) must ensure that personnel and the data center meet a minimum certification level (such as PCI, SSAE 16, ISO 27001) that demonstrates physical and logical security.

Reference the OUC Data Classification Standard for data classes, states, and high-level security requirements, Attachment G on the RFP.

2) Vendor’s Personnel Practices

Vendors or contractors accessing OUC’s network or sensitive data may be required to follow the OUC background check process.

Vendors or contractors directly (locally) accessing the OUC network will be required to use OUC systems to perform required work under its OUC agreement.

3) Compatibility

The proposed solution must be compatible with existing OUC technologies without requiring modifications to those technologies (e.g. Internet Explorer browser version 10 among other requirements). OUC will provide a list of such technologies if requested.

4) Access Control Management

a. Network and Server Layer - The solution must have the ability to limit services and ports into and out of the hosted environment(s) and OUC’s environment.

b. Application Layer - The technologies functionality will support at a minimum a three-tier access management process (i.e., super user, power user, and user).

5) Security Assurance

a. Penetration Testing - the vendor(s) must allow OUC (or an OUC-contracted service) to conduct network penetration testing on a scheduled basis.

b. Security & Health Monitoring - the vendor(s) must allow OUC (or an OUC-contracted service) to monitor the health and security status of OUC’s hosted environment on an ongoing basis.

c. Notification of Security Event – the vendor(s) will notify OUC of a potential or confirmed breach within 4 hours of the discovery.

6) Florida Information Protection Act

The Florida Information Protection Act (FIPA) Florida Statute §501.171 affects all covered entities that acquire, maintain, store or use customers’ personal information.

FIPA also makes it the responsibility of those entities to notify customers when a breach occurs, even if the breach occurs through a third-party.

FIPA expands the definition of “personal information” to include use of a person’s first name or initial and last name in combination with a SSN, driver’s license number, credit card number, account number, security code, password, or email address. Additionally, FIPA has defined “breach of security” to mean unauthorized access to personal information in the system and does not require personal information to be actually acquired before reporting mandates are triggered.

This law covers employees, customers, contractors, applicants or any other individual from whom we have acquired maintained, stored or used personal information.