Exhibit 7 - Information Security & Privacy Requirements.pdf

This exhibit document outlines the information security and privacy requirements for the CrowdStrike renewal software security contract in California. The document establishes mandatory security standards, compliance frameworks, and data protection protocols that the vendor must maintain throughout the contract term. Key requirements include adherence to industry security standards, encryption protocols for data in transit and at rest, regular security assessments and vulnerability testing, incident response procedures, and compliance with applicable federal and state privacy regulations including CCPA and HIPAA where applicable. The vendor must maintain current security certifications, implement multi-factor authentication controls, and provide detailed audit logs and monitoring capabilities. Additional requirements address access controls, personnel security clearances, and segregation of duties to protect sensitive government information.

The document specifies that the vendor must maintain compliance documentation, undergo regular third-party security audits, and provide immediate notification of any security incidents or breaches. The vendor is required to implement business continuity and disaster recovery procedures with defined recovery time objectives and recovery point objectives. Data handling procedures must include secure deletion protocols and restrictions on data retention. The requirements mandate that the vendor maintain cyber liability insurance and demonstrate financial stability. Additionally, the vendor must comply with all applicable state and federal security standards, provide security training documentation for personnel, and allow California government agencies full audit rights including on-site inspections of facilities and systems housing government data.