Summary

This document is an Information Security and Privacy Requirements exhibit for California's email security software procurement. The exhibit establishes comprehensive security and privacy standards that vendors must comply with throughout the contract term. Key requirements include data protection measures, encryption protocols, access controls, and incident response procedures to safeguard sensitive state information processed through the email security platform. Vendors must demonstrate compliance with federal and state privacy regulations, including California Consumer Privacy Act (CCPA) requirements, and maintain documentation of security certifications and audits. The requirements apply to all contractor personnel with system access and extend to any subcontractors involved in service delivery.

The exhibit mandates specific technical controls including multi-factor authentication, regular security assessments, vulnerability management, and audit logging capabilities. Contractors must provide evidence of compliance through third-party certifications such as SOC 2 Type II or equivalent standards and maintain cyber liability insurance. The document requires vendors to notify the state within 24 hours of any suspected security breaches or unauthorized access incidents and to cooperate fully with state investigations. Contractors must also establish data retention and destruction protocols consistent with state records management requirements and agree to allow state personnel to conduct security inspections and testing of the system. These requirements remain in effect for the duration of the contract and any renewal periods.