Exhibit 7 - Information Security and Privacy Requirements

This document is an Information Security and Privacy Requirements exhibit for the State of California's procurement of Cribl SaaS renewal (brand only) under contract opportunity 733002 180003. The exhibit establishes comprehensive security and privacy standards that the vendor must maintain throughout the contract performance period. The requirements encompass data protection protocols, information security controls, privacy safeguards, and compliance obligations designed to protect sensitive state data and systems. The vendor must implement and maintain security measures aligned with state and federal regulatory requirements, including encryption standards, access controls, audit logging, incident response procedures, and data breach notification protocols. All security controls must be documented, maintained, and made available for state review and verification.

The exhibit specifies that the vendor is responsible for ensuring compliance with applicable California privacy laws, federal information security standards, and any additional security requirements established by the state agency. The vendor must conduct security assessments, maintain documentation of security controls, and provide evidence of compliance upon request. Requirements include restrictions on data access and use, employee security training obligations, vulnerability management, and immediate notification procedures for any security incidents or unauthorized access to state data. The vendor must also maintain appropriate insurance coverage and indemnification related to data breaches and security failures, and must cooperate fully with state security audits and assessments throughout the contract term.